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Section I 

GENERAL 



Paragraph 

Introductory remarks concerning transposition ciphers... 1 

Basic mechanism of transposition ciphers 2 

Monophase and polyphase transposition 3 



1. Introductory remarks concerning transposition ciphers. — a. As stated in a previous text, 
' transposition ciphers are roughly analogous to “jigsaw puzzles” in that all the pieces of which 
the original is composed are present but are merely disarranged. The pieces into which the 
picture forming the basis of a jigsaw puzzle may be divided are usually quite irregular in size 
and shape; the greater the amount of irregularity, as a rule, the greater the difficulty in reas- 
sembling the pieces in proper order. In this respect, too, transposition ciphers are analogous to 
jigsaw puzzles, for the greater the amount of distortion to which the plain text is subjected in 
the transposition process, the more difficult becomes the solution. 

b. In jigsaw puzzles there is usually no regularity about the size of the individual pieces 
into which the original picture has been cut, and this feature, of course, materially contributes 
to the difficulty in reconstructing the picture. There are, to be sure, limits (dictated by con- 
siderations of practicability) which serve to prevent the pieces being made too small, for then 
they would become unmanageable; on the other hand, there are also limits which must be ob- 
served in respect to the upper magnitude of the pieces, for if they are made too large the puzzle 
becomes too easy to solve. These features of jigsaw puzzles also have their analogies in trans- 
position methods. In the latter, if the textual units to be subjected to transposition are made 
quite large, say entire sentences, the difficulties a cryptanalyst will have in reconstructing the 
text are practically nil; on the other hand, if these textual units are made quite small, even 
smaller than single letters, 1 then the reconstruction of the transposition text by a cryptanalyst 
often becomes a very difficult matter. In between these two extremes there may be various 
degrees of fragmentation, limited only by considerations of practicability. 

c. It is fortunate, however, that the cryptanalyst does not, as a rule, have to contend with 
problems in which the size of the textual units varies within the same message, as is the case in 
jigsaw puzzles. It is perhaps possible to devise a transposition system in which the text is 
divided up in such a manner that entire sentences, whole words, syllables, individual letters, and 
fractions of letters form the units for transposition ; but it is not difficult to imagine how imprac- 
tical such a scheme would be for regular communication, and it may be taken for granted that 
such irregularity in size of textual units will not be encountered in practical communication.. 

d. The days when the simple methods of word transposition were sufficient for qiilitary 
purposes have long since passed by, and it is hardly to be expected that cryptograms of such 
ineffectual nature will be encountered in the military communications of even the smaller armies 
of today. However, in time of emergency, when a counter-espionage censorship is exercised over 
internal communications, it is possible that isolated instances of simple word transposition may 
be encountered. The solution of such cases should present no difficulties, unless numerous code 
names and nulls are also used in the cryptograms. Mere experimentation with the cryptograms, 
trying various types and sizes of rectangles, will usually disclose the secret text. If code names 



1 Reference is here made to so-called fractionating systems. 
Cryptography, sec. XI. 
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See Special Text No. 166, Advanced Military 
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are used and the context gives no clue to the identity of the persons or places mentioned, it may 
be necessary to wait until additional messages become available, or, lacking such a possibility, 
there is usually sufficient justification, under the exigencies of war, to compel the correspondents 
to reveal the meaning of these code names. 

e. Although transposition ciphers, as a general rule, are much less complex in their mechanics 
than are substitution ciphers, the cryptanalyst usually experiences a feeling of distaste and 
dismay when confronted with unknown ciphers of this category. There are several reasons for 
his dislike for them. In the first place, although transposition ciphers are admittedly less intricate 
than substitution ciphers, as a general rule there are not nearly so many cryptanalytic tools and 
“tricks” to be used in the solution of the former as there are in the latter, and therefore the 
mental stimulus and satisfaction which the cryptanalyst usually derives and regards as part of the 
reward for his hard labor in solving a cipher is often missing in the case of transposition ciphers. 
In the second place, despite their lack of complexity, the solution of transposition ciphers often 
involves a tremendous amount of time and labor most of which commonly turns out to be 
fruitless experimentation. Thirdly, in modem military communication, transposition methods 
are usually not employed alone but in conjunction with substitution methods — and then the 
problems may become difficult indeed, for usually before the substitution can be attacked it is 
necessary first to uncover the transposition. Finally, in working with transposition ciphers a 
much higher degree of accuracy in mere mechanical operations is required than in working with 
substitution ciphers, because the accidental omission or addition of a single letter will usually 
necessitate rewriting the work sheets applying to entire messages and starting afresh. Thus, 
this sort of work calls for a constant state of concentrated attention, with its resulting state of 
psychological tension, which takes its toll in mental wear and tear. 

2. Basic mechanism of transposition ciphers. — a. Basically, all transposition ciphers involve 
at least two processes: (1) Writing the plain-text units (usually single letters) within a specific 
regular or irregular two-dimensional design called a "matrix,” “cage,” “frame,” “rectangle,” 
etc., in such a prearranged manner that the said units are distributed regularly or irregularly 
throughout the various cells or subsections of that design; (2) removing the plain-text units 
from the design in such a prearranged manner as to change the original sequence in which they 
followed one another in the plain text, thus producing cipher text. Since the first process consists 
of inscribing the text within the design, it is technically referred to as the process of inscription; 
and since the second process consists of transcribing the text from the design, it is technically 
referred to as that of transcription. Either or both processes may be repetitive, by prearrange- 
ment of course, in which case the intermediate steps may be referred to as processes of rescription, 
or rescriptive processes. 

b. It is hardly necessary at this point to give the student any indications as to how to 
differentiate a transposition from a substitution cipher. If a review is necessary, however, he 
is referred to Section IV of Military Cryptanalysis, Part I. 

3. Monophase and polyphase transposition. — a. As may be inferred from the foregoing 
definitions, when a transposition system involves but a single process of inscription, followed by 
a single process of transcription, the system may be referred to as monophase transposition, 
commonly called single transposition. When one or more rescriptive processes intervene between 
the original inscription and the final transcription the system may be referred to as polyphase 
transposition. As a general rule, the solution of the latter type is much more difficult than the 
former, especially when the successive transpositions are theoretically correct in principle. 

b. Any system which is suited for monophase transposition is also usually suited for polyphase 
transposition, the processes of inscription, rescription and transcription being accomplished 
with the same or with different keys. 
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SOLUTION OF SIMPLE TRANSPOSITION CIPHERS 



Simple types of transposition Paragraph 

The principles of solution of uniliteral route-transposition ciphers... _ 5 

Keyed columnar transposition with completely-filled rectangles. __ 6 

Example of solution 

The probable-word method of solution " g 

General remarks on solution _ ^ 

Reconstruction of literal key ^ 

Column and row transposition ^ ^ 



4. Simple types of transposition, a. The simple cases of reversed writing, vertical writing, 
or rail fence writing hardly require serious attention, since they may be solved almost by inspec- 
tion. These methods are included here only because they may be encountered in censorship 
operations. 

b. The low degree of cryptographic security afforded by these methods may be increased to 
a slight degree by adding nulls or by disguising the original word lengths, and regrouping into 
false words or into groups of regular length. 



c. Some examples of these simplest types of transposition follow. Let the message be- 
BRIDGE DESTROYED AT ELEVEN PM. 

(1) Reversing only the words and retaining original word lengths: 

Cipher... EGDIRB DEYORTSED T A NEVELE MP 

(2) Reversing only the words and regrouping into false word lengths: 

Cipher.. EGDIRB DEYORT SEDTA NEVE LEMP 

(3) Reversing the whole text and regrouping into fives: 

Cipher... MPNEV ELETA DEYOR TSEDE GDIRB 

(4) Reversing the whole text, regrouping into fives, and inserting a null in every fifth position- 

Cipher... TRIMM PNEVP ELETA ADEYR ORTSL 
EDEGU DIRBM 



(5) Writing the text vertically in two columns and taking the resulting B S 

digraphs for the cipher text, as shown at- the side. The cipher mes- R T 
sage becomes: j 

D 0 
GY 

BSRTIRDOGYEEDDE, or EE 

BIGDSRYDRDEETOE dd 

E 



B R 
I D 
G E 
D E 
S T 
R 0 
Y E 
D 



These simple types can be solved merely by inspection. 

5, The principles of solution of uniliteral route-transposition ciphers.— a. The so-called 
unihteral route-transposition methods are next to be examined. The solution of cryptograms 
enciphered by these methods is a matter of experimenting with geometric figures, usually rec- 
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angles, of various dimensions suggested by the total number of letters in the menage, then 

nspecting these rectangles, searching for whole words or the tirae^rfj 
horizontally, diagonally, vertically, spirally, and so on. 1 (See bpeciai 1 

Military Cryptography, 1935, pars. 20, 21.) . ... 

b. The amount of experimentation that must be performed in the solution of ciphers ol ti is 
type may be materially shortened by means of formulae and tables constructed for the Purpose. 
But because ciphers of this type are of infrequent occurrence today, these formulae and tables 
are only occasionally useful and hence they have not been included in this text. 

6. Keyed columnar transposition with completely-filled rectangles, a. In practical cryp- 
tography, the dimensions of the transposition rectangle, as a general rule, cannot vary between 
large limits; that is, it can be assumed in practice that rectangles based upon lines of writing 
containing less than 5 letters or more than 25 letters will not commonly be encountered. If the 
width, that is, the number of columns, is determined by a key, then the number of rows becomes 
a function of the length of the message to be enciphered. If the latter is very long, longer than 
can be conveniently handled without too many errors, it is a common practice to break up a 
message into two or more parts and treat each part as though it were a separate communication. 

Such parts are commonly termed sections. , ,, 

b. When the last row of a transposition rectangle is completely filled, the solution of the 
resulting cryptogram is considerably more simple than when this is not the case. Conse- 
quently, this will the constitute first case to be studied. 

i It interesting to observe that Daniel, of Biblical fame, was apparently the first cryptanalyst in history 
(as well as one of the earliest interpreters of dreams), for he solved the cryptogram m the handwriting on the 
wall,” obtaining as his decipherment words which he interpreted as predicting the downfall of Belshazzar and 
his dynasty (Daniel V: 1-28). The following partial account of the episode is not as enlightening as one nnght 

banqueting with his lords and drinking wine from the golden vessels of the temple of A HW H, 8 " ‘ " 

seen writing on the wall certain mysterious words. Frightened by the apparition the King ordered h. ^trol- 
ogers to explain the inscription; but they were unable to read it. Darnel was then summoned to the Roy al 
Palace, and the King promised him costly presents if he could decipher the inscription. Daniel read it Mene, 
mene, tekel, upharsin,” and explained it to mean that God had “numbered” the Kingdom ° B ® Is ^ a f "“ed 
brought it to an end; that the King had been weighed and found wanting; and that his Kingdom was divided 

and iriven to the Medes and Persians. , ... , , . , . , , 

The first question which presents itself to the critic, namely, why could the inscription be deciphered by 
Daniel onlv-engaged the attention of the Talmudists, who advanced various answers. Certmn of them 
concluded that the Hebrew writing had been changed in the time of Ezra so that even 
found in the royal court could not read an inscription written in archaic characters. But those who followed 
R. Simeon in maintaining that the writing had not changed found other solutions for ^the ’ P robl ““l *"•**.* 
written in the cryptographic combination W MC, each letter of each pair being substituted by its companion, 
e a Ban no -pm trtn no’; or the words were written thus: ’ 6 P U DV,aB > one ab " v ® otber ’ havl , S . . 

read vertically; or W10’l npV DJX OW, each word backward; or again, fOT® ^ n P xaj xaj the first two letters of 
each word being transposed (Sanh. 22a). It is evident that the author of the Book of Daniel meant tha the 
inscription was written in characters familiar to the King and wise men of Babylon but that, as often happens 
with ancient inscriptions, the transposition of certain letters baffled every attempt to decipher them. . . . 

2 See Lohr, Lenox R. and Friedman, William F., Formulae for the solution of transposition ciphers. Riverban 
Publication No. 19, Geneva, Illinois, 1918. 

* See Special Text No. 165, Elementary Military Cryptography, 1935, Sec. V. In this text the term trans- 
position rectangle” will be used to designate the matrix, frame, cage, or design regardless of whether the latt 
is completely filled or not. 
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c. In solving a cryptogram of this type the first step taken by the cryptanalyst is to ascertain 
the dimensions of the rectangle. Clues for this are usually afforded by finding the factors of 
the total number of letters in the cryptogram. Suppose the cryptogram contains 152 letters. 
The dimensions of the transposition rectangle may be 4X38 or 8X19, by which is meant that 
four hypotheses may be made with respect to its dimensions. The rectangle may consist of; 

(1) 4 columns with 38 rows, or 

(2) 38 columns with 4 rows, or 

(3) 8 columns with 19 rows, or 

(4) 19 columns with 8 rows. 

In practical work it is rather unlikely to encounter a rectangle that conforms to hypothesis (1) 
or (2), and for the present these may be discarded. As to choosing between hypotheses (3) and 
(4), a rather simple test to be described presently will disclose which is the more probable. 

d. It is obvious that if the cryptogram is transcribed within a rectangle of the correct dimen- 
sions, the letters in each row will be the ones which actually were in those rows in the original 
transposition rectangle and formed good plain text therein. In fact, the rows of letters in the 
correctly-dimensioned rectangle would read plain text were it not for the transposition which they have 
undergone within the rows. Therefore, the rows of a correctly-dimensioned rectangle are more 
likely to manifest the expected vowel-consonant proportions of normal plain text than are the 
rows of an incorrectly-dimensioned rectangle, because in the latter case there are brought into 
some of the rows letters which belong to other rows and which are likely to disturb the normal 
vowel-consonant proportions of plain text. That is, in an incorrectly-dimensioned rectangle 
some of the rows will have too many consonants and not enough vowels, in other rows this 
relationship will be reversed; whereas in a correctly-dimensioned rectangle each row will have the 
proper number of vowels and consonants. Hence in solving an unknown cryptogram of this 
type, if a count is made of the vowels and consonants in the rows of rectangles of various probable 
dimensions, that rectangle in which the rows show the best proportions of vowels and consonants 
is most likely to be correct, and the one that should be tried first. 

e. Having ascertained the correct dimensions of the rectangle by the foregoing procedure, 
the next step is to experiment with the columns of the rectangle, trying to bring together several 
columns which will then show “good” digraphs, trigraphs, or polygraphs in the rows formed by 
juxtaposing the columns. This process of combining or matching columns in order to build up 
these fragments of plain text will her ein be referred to as a nagramming. 4 

f. The procedure is to select a column which has a good assortment of high-frequency letters 
and find another column which may be placed before or after the selected column to build up 
high-frequency digraphs in the rows; when such a pair of columns has been found, attempt is 
made to add another column before or after this pair to build up high-frequency trigraphs, and 
so on, gradually building up longer and longer polygraphs until entire words begin to appear in the 
respective rows of the rectangle. In this process of anagramming, advantage may be taken 
of simple mathematical considerations such as adding the normal plain-text frequency values of the 
digraphs in the rows to assist in discarding combinations which are on the borderline of choice. 
However, it must be noted that the totals obtained by simple addition of the frequency values of 

4 The Standard Dictionary defines the word anagram as follows: “(noun) 1. The letters of a word or phrase so 
transposed as to make a different word or phrase; as, ‘time’ and ‘mite’ are anagrams of ‘emit’. 2. A transposition; 
interchange.” As a verb, it is defined as “to anagrammatize; to make an anagram of; make anagrams.” (The 
construction of anagrams was a very widespread pastime in previous centuries. See Wheatley’s Of Anagrams, 
London, 1862.) A strict interpretation of the word would therefore confine it to cases wherein the letters to be 
rearranged already form bonafide words or intelligible phrases. However, this would hardly be broad enough for 
cryptanalytic purposes. As used in cryptanalysis the word is commonly employed as a verb to refer to the proc- 
ess of rearranging the disordered letters of cipher text so as to reconstruct the original plain text. 



REF ID : A59439 




6 

the digraphs should be considered only as rough approximations or guides in weighing probabil- 
ities in favor of one hypothesis as against another, for theoretically the probability of the simul- 
taneous occurrence of two or more independent events is the product, and not the sum, of their 
respective probabilities. In most cases the calculation of products involves an amount of labor 
unwarranted by the results to be expected, so that simple addition of probabilities is usually 
sufficient. However, if tables of the logarithms of the probabilities are readily available, the 
addition of these logarithms becomes a simple matter and affords a more accurate guide in selec- 
tion of combinations produced in the anagramming process. 5 Once a set of four or five columns 
has been correctly assembled it is usually the case that the process may be completed very quickly, 
for with the placement of each column the number of remaining columns possible for selection 
diminishes; toward the close of the process, when only two or three columns remain, their place- 
ment is almost automatic. 

g. It is desirable, as a final step, to try to reconstruct, if possible, the literal key from which 
the numerical transposition key was derived. 

7. Example of solution.— a. Given the following cryptogram, the steps in solution will be 
set forth in detail: 

Cryptogram (126 letters) 

ILHHD TIEOE UDHTS ONSOO EEEEI OEFTR 

RHNEA TNNVU TLBFA EDFOY CAPDT RRIIA 

RIVNL RNRWE TUTCU VRAUO OOFDA ONAJI 

UPOLR SOMTN FRANF MNDMA SAFAT YECFX 

R T G E T A 

b. The cryptogram contains 126 letters (factors of 126: 2, 3, 6,7,9, 14, 18, 21), suggesting 
rectangles of 7X18 or 9X14. If the former dimensions are taken, the rectangle may have 7 
columns and 18 rows or 18 columns and 7 rows; if the latter dimensions are taken, it may have 9 
columns and 14 rows or 14 columns and 9 rows. The factors of 126 do not, of course, preclude 
the possibility that the rectangle may he 6X21, that is, with 21 columns and 6 rows or 6 columns 
and 21 rows. If no good results were obtained by testing rectangles of the dimensions indicated 
(7X 18 or 9X 14), then one would proceed to test rectangles 6X21. In the event that all tests on 
the basis of a completely-filled rectangle failed, then it would be assumed that the rectangle may 
be incompletely filled. In making the vowel-consonant test described in paragraph 6 d, it is 
advisable to base the count on the columns as well as on the rows of a rectangle, since it is possible 
that the cryptogram was prepared by inscribing the plain text in rows and transcribing the text 
from the columns, or vice versa. After examining a rectangle both horizontally and vertically, 
it is often possible to discard various arrangements without further tests. For example, at A 
in figure 1 there is shown a rectangle of 7 columns and 18 rows. Now in a row of 7 letters there 
should be (7X40 percent=2.8) either 2 or 3 vowels; but rows 12 and 15 contain no vowels at all 
and rows 8 and 9 contain 5 vowels, row 16, 6 vowels. It is concluded at once that this arrange- 
ment is highly improbable. If the plain text had been inscribed vertically in this same rectangle, 
and then the rows had been transposed in forming the cipher text, then in each column (18 letters) 
there should be (18X40 percent— 7.2) about 7 vowels; but column 2 contains 11 vowels and col- 
umn 6 only 4. This likewise indicates that it is highly improbable that the message was inscribed 
vertically and the cryptogram formed by transposing the rows. But when the arrangement at 

5 A suggestion tor which the author is indebted to Mr. A. W. Small, junior cryptanalyst in this office. The 
principle makes practicable the use of tabulating machinery for the purpose of speeding up and facilitating the 
matching of columns in the anagramming process. 
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B in figure 1 is studied, it is not so easy to say at once that it is improbable. For in 18 letters 
there should be about 7 vowels and none of the rows of this arrangement shows too great a 
departure from this expected number. This possibility will have to be explored further and it 
is for the moment put aside. If it be assumed that the message was inscribed vertically in the 
rectangle 18X7 and the rows subjected to transposition, there should be (7X40 percent=2.8) 
2 or 3 vowels in each column. But since several of the columns show rather considerable depar- 
tures from this expected number, it may be concluded that a vertical inscription and horizontal 
transcription is not probable and this assumption may be eliminated. Then the arrangements 
at C and D in figure 1 are studied in the same manner, with the result that at the end of the study 
the situation as regards the various assumptions is summarized as follows: 




WJ ■Him ■MINI ■MINI ■MINI ■MINI ■MINI lllllll ■IIIIM II III lllllll II III lllllll II III lllllll II III lllllll IIIINI ■^l|lll 



7 X 18 



1 2 3 4 5 6 7 



0 
E 
U 
D 

l H 

14 T 



15 S 

16 0 



17 N 

18 S 



0 N T 

0 N R 
E V R 
E U I 
E T I 
E L A 

1 B R 
0 F I 
E A V 
FEN 
T D L 
R F R 
RON 
H Y R 
N C W 
E A E 
APT 
T D U 



T U M 
CPA 
U 0 S 
Y L A 
R R F 
ASA 
U 0 T 
0 M Y 
0 T E 
0 N C 
F F F 
DRX 
AAR 
0 N T 
N F G 
A M E 
J N T 
IDA 



9 X 14 



Number oil o a a 
vowels J — * 4 * 



213241255212 



Number of 
vowels . 



I 


S 


T 


B 


R 


T 


A 


T 


F 


L 


0 


R 


F 


I 


U 


0 


N 


A 


H 


N 


R 


A 


I 


T 


N 


F 


T 


H 


S 


H 


E 


A 


C 


A 


R 


Y 


D 


0 


N 


D 


R 


U 


J 


A 


E 


T 


0 


E 


F 


I 


V 


I 


N 


C 


I 


E 


A 


0 


V 


R 


U 


F 


F 


E 


E 


T 


Y 


N 


A 


P 


M 


X 


0 


E 


N 


C 


L 


U 


0 


N 


R 


E 


E 


N 


A 


R 


0 


L 


D 


T 


U 


I 


V 


P 


N 


0 


R 


M 


G 


D 


0 


U 


D 


R 


0 


S 


A 


E 


H 


E 


T 


T 


W 


F 


0 


S 


T 


T 


F 


L 


R 


E 


D 


M 
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A 



14 X 9 



g 9 10 11 12 13 14 



E 0-F N 
U 0 T N 



E T N T 
D R L C 



D E R V 
H E R U 



F R R U 
0 I N V 



T E H T 
S E N L 



Y I R R 
C A W A 



0 I E B 
N 0 A F 



A R E U 
PITO 



SETADVUO 



OUNMC 
F P F A F 
D 0 R S X 
A L A A R 

0 R N F T 
N S F A G 
A 0 M T E 
JMNYT 

1 T D E A 






18 X 7 

3 9 10 11 12 13 14 15 16 17 18 



IESETTBYRNTAAPTMFX 

LOOERNFCILUUOONNAR 



HENERNAAIRTONLFDTT 

HUSIHVEPANCOARRMYG 



5 DDOONUDDRRUOJSAAEE 

6 THOEETFTIWVFIONSCT 



THOEETFTIWVFIONSCT 

ITEFALORVERDUMFAFA 



Number ofl 
vowels y 



3922442553152 

D 



.6 10 3557735 



Rectangle 7 X 18 

7 columns and 18 rows: 

(1) Horizontal inscription, columnar transcription Very improbable. 

(2) Vertical inscription, horizontal transcription Very improbable. 

18 columns and 7 rows: 

(3) Horizontal inscription, columnar transcription Possible. 

(4) Vertical inscription, horizontal transcription. Improbable. 



Rectangle 9 X 14 

9 columns and 14 rows: 

(5) Horizontal inscription, columnar transcription Possible. 

(6) Vertical inscription, horizontal transcription Improbable. 

14 columns and 9 rows: 

(7) Horizontal inscription, columnar transcription Improbable. 

(8) Vertical inscription, horizontal transcription.. Very improbable. 

e. Discarding all assumptions except (3) and (5), the latter are subjected to further scrutiny. 
Suppose the average amount of deviation from the expected number of vowels in each row is 
calculated by finding the difference between the actual and expected numbers in each row, 
o^ffing these differences (neglecting signs), and dividing by the total number of rows. For as- 
sumptions (3) and (5) the results are as follows: „ ^ 
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Figure if . 

The average amount of deviation for assumption (5) is only 0.9 as against 1.2 for assumption 
(3) ; therefore the former assumption is considered to be somewhat better than the latter and it will 

be tried first. , . , 

d The columns of the rectangle shown in figure 1/ are now to be cut apart and the procedure 

of anagramming applied. (For this it is best to have the cryptogram written on cross-section 
paper preferably with X-inch squares for ease in handling.) Consider column 7, with the letter 
J in row 5; this letter, if it is a part of a word, must be followed by a vowel, which eliminates 
columns 1, 3, 4, and 5 as possibilities for placement on the right of column 7. Here are t e 
digraphs formed by combining column 7 with columns 2, 6, 8, and 9, respectively, and the totals 
obtained by adding the frequency values of the digraphs formed in the rows: 
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( The frequencies shown are as given in table 6, appendix to Military Cryptanalysis, Part I.) 

(1) (2) (3) (4) 







& 




& 




>> 

o 






& 






Frequen 

value 




§3 




Frequen 

value 








7 


2 


7 6 


§•! 

s' - 

fa 


7 8 


7 


9 


c/gl 

fa 


A 


s 


... 41 


A T 


... 47 


A T... 


47 


A 


F 


4 


0 


0. 


6 


0 U 


... 37 


0 N... 


77 


0 


A 


7 


N 


N - 


8 


N T 


... 82 


N F 


9 


N 


T 


82 


A 


s 


.. 41 


A C 


... 14 


A R 


44 


A 


Y 


12 


J 


0 


2 


J U. 


2 


J A 


1 


J 


E 


2 


I 


0 - 


.. 41 


I V 


... 25 


I N 


75 


I 


C 


22 


U 


E 


.. 11 


U R....... 


... 31 


U F 


1 


U 


F 


1 


P 


E 


.. 23 


P A 


... 14 


P M 


4 


P 


X 


0 


0 


E - 


3 


0 U 


... 37 


0 N 


77 


0 


R 


64 


L 


E 


.. 37 


L 0 


... 13 


L D 


9 


L 


T.. 


8 


R 


T 


. 30 


R 0 


... 28 


R M 


9 


R 


G 


7 


S 


0 


.. 15 


S 0 


... 15 


S A 


24 


S 


E 


49 


0 


E 


3 


0 F 


... 25 


0 S 


14 


0 


T 


19 


M 


F 


1 


M D 


1 


M A 


36 


M 


A 


36 




Total 


262 


Total... 


... 371 


Total 


427 




Total 


313 



Figure 2. 

Combination (3) gives the highest frequency value for the digraphs and an attempt is made to 
add a column to it. Here are some of the combinations tried: 
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e. Each of these combinations shows at least one “impossible” trigraph and several “poor” 
ones. 6 After more or less work along these lines, the cryptanalyst begins to get the feeling that 
“something is wrong,” for, as a rule, once a correct start has been made in cases of this kind, 
solution comes rather quickly. Hence, the cryptanalyst decides here that possibly his first 

6 Following the steps taken in subpar. d, frequency weights may be given the various trigraphs in fig. 3 and 
the sums obtained taken as indications of the relative probability of each of the four trials. These steps are here 
omitted, for they are obvious. 
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choice of combination (3) was a bad one, even though it gave the greatest totals when 
values for the digraphs were summed. The second greatest total was or co 
which columns 7 and 6 were put together. The infrequent digraph J U sugges s a wo 
JUST or JUNCTION. If it were the former there should be a column containing an Sin > 

and there is no such column. If the word is JUNCTION, there should be a cohimn contammg an N 
in the 5th row, and there is only one such column, the 3d. Placing column 3 after cohmrns 7-6 
gives the trigraplis shown in figure 4-A. All of these trigraphs are excellent except the last, a d 
that one may be either an abbreviation of a signature, or possibly nulls added to complete st ie rec- 
tangle If the word JUNCTION is correct then there should be a column with a C m the 5th row , but 
none is found. However, column 9 has a C in the 6th row, and if it happened that the last c ^ u “n 
on the right is No. 3, then column 9 would be the 1st column. Thus, as shown in figure 4-B, the 
arrangement of columns becomes 9 7 6 3. 

7fl 3 g7????763 915284763 

ATT F ATT FIRSTBATT 

OUR A OUR ALIONFOUR 

NTR T . . N T R THINFANTR 

ACH y ’. . . . . A C H YHASREACH 

JUN E JUN EDROADJUN 

XVE C . . . . I V E CTIONFIVE 

U R A F URA FIVEFOURA 

PAT X PAT XENEMYP AT 

0UN r OUN ROLENCOUN 

t 0 m t LON TEREDALON 

rOV G ROV GUNIMPROV 

SOU E SOU EDROADSOU 

0FT T OFT THWESTOFT 

M D L A MDL ATEFARMDL 

Figure 4-A. FlGUBK 

/ It is believed that the procedure has been set forth with sufficient detail so as to make 
further demonstration unnecessary. The rectangle can be completed very quickly and is found 

to be as It ^ n b “®^ t J ng tQ see if a ca i cu lation based upon the sum of the logarithms of the 
probabilities given in figure 2 would have given the correct combination as the first choice 
Note the results shown in figure 6. This calculation gives the correct combination as first 
choice, viz, 7-6, with a logaritlimically-weighted value of 17.35 as against a value of 16.51 for 
combination 7-8, which was the first one tried on the basis of merely the sums of the frequency 

values of the digraphs. 
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Figure 6. 



As a matter of interest, it may be observed that the combination 7-6 is 7 times more probable 
than combination 7-8, since the difference between 17.35 and 16.51 is .84, which is the logarithm 
of 7. Likewise, combination 7-6 is roughly 15,000 times more probable than combination 7-9, 
since 17.35—13.17=4.18. 

8. The probable-word method of solution. — a. The probable-word method of attack is as 
important in the solution of transposition ciphers as it is in the solution of substitution ciphers, 
and if the cryptanalyst is able to assume the presence of such probable words as are usually 
encountered in military communications, the solution, as a rule, comes very quickly. 

b. As an illustration, looking at the first row of letters in the rectangle shown in figure 1/, 
the letters ISTBRTATF almost at once suggest FIRST BATTALION as the initial words of the 
message. A rearrangement of the columns of the cryptogram to bring the necessary letters 
into juxtaposition at once discloses the key. Thus: 

915284763 

FIRSTBATT 

A L I 0 N 

It will be noted that this assumption requires that there be a column headed by F A, another 
headed by I L, another headed by R I, and so on. Had such columns not been found, then the 
word BATTALION would not be possible. In that case the word FIRST would still remain as a 
point of departure'for further experimentation. 

c. In the foregoing illustration, the probable word was assumed to appear in the first line 
.of text in the rectangle. If the probable word being sought is in the interior of the message, the 

steps must be modified somewhat but the basic principle remains unchanged. The modifications 
are of course obvious. 

9i General remarks on solution. — a. In solving transposition ciphers advantage should be 
taken of all the characteristics and idiosyncrasies which are applicable to the language of the 

324153 — 11 2 
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enemy, because they often afford clues of considerable assistance to the cryptanalyst. In all 
languages there are certain letters, usually of medium or low frequency, which combine with 
other letters to form digraphs of high frequency. For instance, in English the letter H is of 
medium frequency, but it combines with T to form the digraph T H, which is of highest frequency 
in literary text; it also combines with C, a letter of medium frequency, to form the fairly frequent 
digraph C H. The letter V is almost in the low-frequency category yet it combines with E to 
form the digraph V E, which in military text is the 14th in frequency. The low-frequency letter 
K often combines with C to form the digraph C K. Consequently, in working with transposition 
ciphers in English, when there is an H, attempts should be made to combine it first with a T or 
with a C ; a V should be combined first with an E ; a K should be combined first with a C ; and so on. 

b. There is usually in every language at least one letter which can be followed by only a 
certain other letter, forming what may be termed an obligatory sequence, or an invariable digraph. 
In all languages having the letter Q, the combination Q U constitutes such an invariable digraph. 7 
In bonafide words of the German language the letter C is never used by itself ; when present the 
letter C is invariably followed by an H, except on rare occasions when the digraph C K is employed. 
In English, the letter J can be followed only by a vowel; the letter X can only be preceded by a 
vowel and, except at the end of a word, can only be succeeded by a vowel, or by one of a limited 
number of consonants (C H P T), and so on. Letters which behave in this manner, that is, 
letters which have what may be called a limited affinity in combining with other letters to form 
digraphs, constitute good points of departure for solution and are therefore of sufficient impor- 
tance to warrant their being designated by the more or less descriptive name of pilot letters. 

c. The presence of pilot letters in a transposition cipher often forms the basis for the assump- 
tion of probable words. Obviously, a special lookout should be kept for words of rather high 
frequency (in military correspondence) which contain letters of low or medium frequency. 
The frequent word CAVALRY, for example, would suggest itself if the cryptogram has the letters 
C, V, L, and Y, which are all of medium frequency. The important word ATTACK suggests 
itself if the cryptogram has a K, a letter of low frequency, and a C, one of medium frequency; 
and so on. 

d. The mechanics of simple columnar transposition make possible the production of rather 
long sequences of vowels and long sequences of consonants in the text of the cryptogram. Note, 
for example, in the cryptogram on p. 6, the sequence of vowels OOEEEEIO'E, and the 
sequence of consonants V N L R N R W. If the enciphering or plain-text rectangle is con- 
sulted, it will be seen that these two sequences belong together, that is, they are in adjacent 
columns in that rectangle. It is a characteristic of plain text that consonant-vowel or vowel- 
consonant digraphs are much more frequent than consonant-consonant or vowel-vowel digraphs, 8 
and therefore when long sequences of consonants and of vowels are found in transposition 
ciphers, a good start toward solution may result from assuming that such sequences come from 
adjacent columns. 

e. It should, however, be noted in connection with tell-tale letters such as Q (entering into 
the composition of QU) and C (entering into the composition of CH), that astute cryptographers 
who realize the clues which such letters afford often replace invariable digraphs by single char- 
acters, usually those rarely used in the language in question. For example, C H in German may 
be replaced by Q, Q U in French, by K, and so on. When this is done, solution is made more 
difficult; but only in those cases where it is dependent upon finding letters forming obligatory 
sequences in plain text does this sort of subterfuge become a factor of importance. 

7 The letter Q may, of course, be part of an abbreviation, such as SQ for “square,” or it may be used as a null, 
or as a sign of punctuation. However, unless there are good reasons for believing that this letter is used for such 
purposes, QU may be considered to be an invariable digraph. 

8 The CV and VC digraphs constitute about 62 percent of all digraphs. 
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i /. The presence of many Q’s, or K’s, or X’s in a transposition cipher should not, however, be 
lom as prima facie evidence of the type of replacement noted in the preceding subparagraph, 
pa possible that such letters may be used as sentence separators or other punctuation ■ possiblv 

*■ i. l u ,, . . y 






Aey may be nulls, although the alert cryptographer would either use nulls not at all or if he 
m to, would use letters of medium or high frequency for this purpose. 

,UL' 9' Because it is important that the cryptanalyst take advantage of every peculiarity specifi- 
cally applicable to a cryptogram to be solved, especially as regards the presence of low-frequency 
tetters, it is advisable that a uniliteral frequency distribution be prepared, just as though he 
were going to deal with a substitution cipher. This is probably the quickest way of bringing to 
Ij gh t the peculiarities which may be helpful in solution. 

; 10 . Reconstruction of literal key. a. The reconstruction or recovery of the literal key 

from which the numerical transposition key was derived is naturally the last step in the solution 
c$ cryptograms of this type. It is often of more than merely academic interest, because if it is 
fMffid that the enemy is employing for this purpose some well-known book, or words or phrases 
of a simple nature associated with the locale of operations, this fact may be of highest importance 
imsuhsequent work. 

b. In this process there are only a few guiding principles to be noted and much must be left 
to the ingenuity and imaginative powers of the cryptanalyst. Taking as an example the numer- 
ical key uncovered in the solution of the cryptogram in paragraph 7, the procedure will be set 
/orth below. 

c. The numerical key referred to was found to be 915284763. Assuming that this 
sequence was derived in the usual manner, by assigning numbers to the letters of a key word in 
accordance with their relative positions in the normal alphabet, the sequence forms the basis for 
Ihe key-word reconstruction diagram shown in figure 7-A, in which the individual key numbers are 
written from left to right on different “levels” so that each level contains only numbers normally 
in succession. 
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Ficcbe 7-A. 



rAm , 0= ' , 1S . ’ e y t mt tlie digit 1 on the first level in the key-word reconstruction diagram 
nT , ft, ^ a lett , r at or at least close t0 the beginning of the alphabet. Since the digits 2 and 3 
e same level as the .digit 1, it is likely (1) that the letter represented by 1 occurs 2 more 
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times in the key word, or (2) that the digit 2 represents another letter, also near the beginning o 
the alphabet, and that this letter is repeated, or (3) that the digits 2 and 3 represent 2 different 
letters both near the beginning of the alphabet, or (4) that all three digits represent different 
letters but all near the beginning of the alphabet. The digit 4, on the second level in the recon- 
struction diagram, must represent a letter beyond the letter represented by the digit 3 ; the digit 
5 must represent one beyond the letter represented by the digit 4, and the digit 6 may represent 
the same letter as 5, or a letter not much beyond that represented by 5. Assuming that the 
letters composing the key word are fairly well distributed over the entire alphabet, the digit 7 
must represent a letter near or slightly beyond the middle of the alphabet, the digit 8 must repre- 
sent one further toward the end of the alphabet than does the digit 7, and so on. Assigning 
several values to the digits, in accordance with the foregoing principle, the results are as shown 
in figure 7-B. 

e. It is perhaps possible that some students may find the process of reconstructing the literal 
key somewhat easier if the variant possible letters are merely listed under the respective key 
numbers as shown in figure 7-C. The candidates for the successive positions in the literal key 
thus appear in a rather condensed space and the eye is able to pick up “good” combinations 
very quickly. 

9 15284763 

RAKAMFLKA 

SBLBNGMLB 

TCMCOHNMC 

UDNDPIOND 

VEOERJPOE 

W 

X 

Y 

Z 

Figure 7-C. 

/. Now comes the trying process of finding a “good” word in this assemblage of letters. The 
beginning and end of the word are the easiest points of attack, and it is useful to keep in mind the 
relative frequency order of letters as initial and final letters of the language in question. For 
English, the data are as follows: 9 



As initial letters T SAFCORDNPEMIWBHLUGYVJQKZX 

As final letters E TDSNYROHLAFGPMXCKWUBIZQJV 



Studying the candidate letters at the end of the key, it is seen that E is one of the possibilities. 
If that is correct, then a good ending would be one of the type vowel-consonant-vowel, with E as 
the final letter. There is but 1 vowel in the fourth level in the column under the digit 7, the 
letter 0. This gives 0 K E, 0 L E, 0 M E, 0 N E as possible terminal trigraphs, the best of which 
from a frequency standpoint is ONE. Seeing the letters P and H in columns 8—4, the ending 
PHONE and then the word TELEPHONE suggests itself. Checking to see if there are any incon- 
sistencies, none is found and the solution is: 

Numerical key -9 15284763 

Literal key T ELEPHONE 

* Taken from Tables 2-D (2) and 2-E (2), p. Ill, Military Cryptanalysis, Part I. 



17 



g. In future studies, cases will be encountered wherein the reconstruction of the n um erical 
key is an essential or, at least, a useful element after the solution of one or more cryptograms has 
been achieved by cryptanalysis. This is done in order that subsequent cryptograms in the same 
key can be read directly without cryptanalysis. The reconstruction of the numerical key is, 
however, a different process than the one illustrated in this paragraph, wherein the problem is 
solely one of building up a literal key from its numerical equivalent. The purpose in reconstruct- 
ing the literal key is to give clues as to the source frotn which keys are derived or taken. Some- 
times this may lead to ascertaining a book which is used for this purpose and which may be 
available by purchase at bookshops; or it may be a well-known document, a telephone directory, 
etc. Obviously, if the source document or book can be located the solution of future crypto- 
grams in the same system becomes merely a matter of decipherment and such cryptograms no 
longer form the material for cryptanalytic efforts. The method of reconstructing the literal 
key is, obviously, easier to apply in the case of long numerical keys than in the case of short ones; 
in general, the longer the numerical key the easier is the recovery of the literal key. 

11. Column and row transposition. — It should be obvious that when the rows as well as 
the columns of a completely-filled rectangle undergo transposition the increase in security is 
hardly worth mention, since the underlying procedure in solution aims simply at assembling a 
few columns on the basis of “good” digraphs and trigraphs brought to light by juxtaposing 
columns. After three or four columns have been properly juxtaposed, the placement of addi- 
tional columns becomes easier and easier, merely by continuing to build upon the fragments of 
words in the rows. Hence, the cryptanalyst is, during a large part of the process, not particularly 
interested in the intelligibility of the text he is building up ; only at the end of the process does 
this become a factor. When all of the columns have been assembled in proper order, then the 
text will read continuously in the normal manner (left to right, top to bottom) . If it does not, 
then it is usually a very simple matter to rearrange the rows of the rectangle to bring this about, 
since the letters at the ends and beginnings of the rows give the necessary clues for continuity. 
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Section III 

INCOMPLETELY— FILLED RECTANGLES 

Paragraph 
1 2 

General principles underlying solution “ 

Delimiting the lengths of the columns of the rectangle; constructing the “hat” diagram.— 13 

Solution of example 

Alternative method of solution fjj 

Concluding remarks on simple columnar transposition - - 

12. General principles underlying solution. — a. In the system designated keyed columnar 
transposition the feature which differentiates an incompletely-filled rectangle from one that is 
completely filled is a very simple one from the cryptographic point of view: The bottom row of 
the rectangle in the former case merely lacks one or more letters, a feature which only very 
slightly complicates the system in practical operation. But the consequences of this simple 
difference between the two types are, from the cryptanalytic point of view, quite profound, and 
the cryptanalytic effect of this small change in cryptographic procedure is seemingly all out of 
proportion with the simplicity of the difference. 

b. Cryptograms involving completely-filled rectangles arc rather easy to solve because of two 
circumstances. In the first place, since the rectangle is completely filled, the various possible 
dimensions of the rectangle can be ascertained by noting the factors of the total number of letters. 
Usually only a few possibilities are indicated and therefore this materially reduces the amount of 
experimentation that would be required in the absence of this situation, since it is obvious that 
when working with incompletely -filled rectangles a good many rectangles of various dimensions 
become possibilities for trial. In the second place, the columns in a completely -filled rectangle 
all contain the same number of letters, and therefore the anagramming process (matching and 
assembling of columns) can be performed without any mental reservations such as must be made 
in working with incompletely -filled rectangles because of uncertainty as to whether the letters 
which are juxtaposed to form digraphs and trigraphs really come from the same row in the plain- 
text rectangle. The latter statement calls for a bit more explanation. 

c. The columns of an incompletely -filled rectangle are of two sorts which may conveniently 

be designated as long and short. The long columns are at the left of the rectangle and each one 
contains just one more letter than the short columns, which are at the right. This follows, of 
course, from the fact that it is only the last row in such a rectangle which lacks one or more letters 
to complete the rectangle. The term width, as applied to a transposition rectangle, will be con- 
venient to designate the number of columns, which is, of course, determined by the length of the 
numerical key or the number of letters in the literal key. Given the width of the rectangle and 
the total number of letters in the cryptogram, the length and number of the long and the short 
columns may be found by a simple calculation: Multiply the width of the rectangle by the 
smallest number which will yield a product greater than the total number of letters in the 
cryptogram. The multiplier gives the length of the long columns ; this multiplier minus 1 gives 
the length of the short columns; the excess over the total number of letters gives the number of 
short columns; the latter deducted from the width gives the number of long columns. Thus, 
with a cryptogram of 287 letters and a rectangle 15 columns in width: [(15X20) 13=287] the 

( 18 ) 
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long columns will have 20 letters, the short ones, 19 letters; there will be 13 short columns and 2 
long ones. 

d. Now if the cryptanalyst were able to cut up the text of a cryptogram produced from an 
incompletely-filled rectangle into sections corresponding in length with the actual long and short 
columns, he could handle these columns in exactly the same manner that he handles the equal- 
length columns in the solution of a cryptogram produced from a completely-filled rectangle. In 
fact, the solution would be easier because he knows that all the short columns fall at the right, 
all the long columns at the left of the transposition rectangle, and therefore the amount of experi- 
mentation he must undertake in his attempts to juxtapose columns in the anagramming process is 
considerably reduced. But, unfortunately, there is usually no way in which, at the initial stage 
of solution, the cryptanalyst can find out, from a single cryptogram, which arc the long columns 
and which the short. This is obviously a matter directly connected with the specific transposi- 
tion key, and the latter is the sole unknown factor in the whole problem. 

e. If it were practicable to transcribe a cryptogram of this type according to all the possible 
transposition keys for a given width of rectangle, solution would obviously merely consist in 
scanning the various rectangles to find the one which is correct — for there will be only one such 
rectangle. A rectangle 15 columns in width may have been enciphered by any one of factorial 
15 transposition keys. 1 While it is conceivable that machinery might be devised for this purpose, 
so that the production of the millions of possible rectangles could be effected in a relatively short 
time, in the present state of the art no such machinery has yet been devised. Furthermore, it is 
problematical whether a solution by such means could be achieved in a reasonable length of time 
even if the machinery were available, because of the immensity of the task it would have to 
perform. 2 

/. However, this question may be asked: Given a cryptogram of t letters and a rectangle of 
n columns in width, is it possible to transcribe the text within a single rectangle so that the latter 
will show what letters will constitute the respective columns for all possible transposition keys of 
n elements? If so, then such a rectangle would be useful in trying to solve the cryptogram, 
because the rectangle would then limit the amount of experimentation that would have to be 
performed by the anagramming process, since it would show whether or not two letters which 
are brought together in that process to form a digraph could possibly have been in the same row 
in the plain-text rectangle. If not, then of course there would be no use in forming such digraphs, 
and thus the number of trials becomes much reduced. Another way of indicating what is meant 
is to say that such a rectangle would show the maximum amount that one column may be shifted 
up or down in trying to match it with another column in the anagramming process. This will be 
made clearer in a subsequent paragraph. At this point it will merely be stated that it is easy to 
prepare a rectangle of the nature indicated above for any keyed, columnar-transposition 
cryptogram. 

1 Factorial 15, or 15X14X13X. . .XI, equals 1,369,944,576,000 different transposition keys. 

2 It is nevertheless pertinent to indicate that machinery for facilitating the “matching” or anagramming of 
columns has been devised and found to be quite practical in the solution of problems involving columnar trans- 
position. 
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13. Delimiting the lengths of the columns of the rectangle; constructing the “hat” dia- 
gram. — a. Given the following cryptogram of 224 letters and an assumed width of 12 columns 
in the enciphering rectangle: 

Cryptogram 



0 


D 


N 


N 


P 


T 


I 


R 


N 


T 


D 


T 


U 


R 


0 


E 


X 


A 


L 


N 


I 


E 


T 


G 


N 


W 


T 


T 


M 


E 


D 


S 


T 


E 


0 


I 


T 


D 


M 


A 


N 


L 


N 


0 


E 


B 


0 


U 


H 


E 


N 


L 


E 


S 


E 


A 


A 


C 


T 


R 


M 


S 


C 


L 


c 


S 


0 


E 


F 


C 


F 


F 


T 


E 


E 


E 


M 


I 


A 


I 


T 


E 


A 


I 


J 


N 


S 


0 


I 


V 


F 


M 


B 


I 


E 


H 


B 


V 


T 


B 


E 


S 


R 


S 


Y 


L 


X 


R 


0 


R 


U 


M 


E 


T 


Y 


0 


I 


K 


N 


K 


T 


N 


D 


A 


H 


I 


R 


H 


Q 


I 


E 


T 


E 


T 


N 


0 


T 


R 


A 


A 


V 


R 


I 


R 


S 


T 


G 


S 


E 


F 


E 


A 


0 


0 


T 


H 


E 


A 


C 


N 


S 


H 


E 


E 


V 


T 


R 


E 


S 


R 


A 


I' 


I 


E 


A 


T 


E 


E 


A 


L 


A 


E 


N 


E 


E 


M 


Y 


T 


F 


I 


T 


A 


N 


L 


N 


N 


U 


A. 


c 


L 


R 


E 


N 


R 


T 


R 


A 


T 


S 


0 


A 


L 


0 


D 


I 


R 


0 


R 


Y 


N 


N 


R 


G 


Y 



































DISTRIBUTION" 



g 

a 




ABCDEFGHIJKLMNOPQRSTUVWXYZ 



15 4 6 0 31 6 3 6 16 1 2 9 7 20 15 1 1 18 12 25 4 4 1 2 5 0 (224) 

b. A cryptogram of 224 letters and a rectangle of 12 columns [(12X19) — 4=224] indicates 4 
short columns of 18 letters and 8 long columns of 19 letters. The outlines of a rectangle of this 
specification are drawn on a sheet of cross-section paper and the text is transcribed within it, 
for the moment assuming only that the transposition key consists merely of the straight sequence 
of numbers 1 to 12. Thus: 

1 2 3 4 5 0 7 8 9 10 11 12 

0NMCMHYT0AFA 
DIATIB0N0IIT 
NENRAVIOTITS 
NTLMITKTHEA0 
PGNSTBNREANA 
TN0CEEKAATLL 
IWELASTACEN0 
RTBCIRNVNEND 
NT0SJSDRSAUI 
TMU0NYAIHLAR 
DEHESLHREAC0 
TDEF0XISEELR 
USNCIRRTVNRY 
RTLFV0HGTEEN 
0EEFFRQSRENN 
E0STMUIEEMRR 
XIEEBM E F S Y T G 
ATAEIETERTRY 
LDAEETEA 



Fwobe 8. 
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c. The rectangle shown in figure 8 is the same as though it had been assumed that the key 
numbers 9, 10, 11, and 12 happened to fall at the extreme right in the numerical transposition 
key. Columns 1 to 8, inclusive, would then be long columns, and columns 9, 10, 11, and 12 would 
be short columns. But suppose that the key numbers on the extreme right happened to be 1, 2, 

3, and 4, instead of 9, 10, 11, and 12. Then columns 1, 2, 3, and 4 would be the short columns, 
5 to 12 the long ones. In this case, making reference to figure 8, the final letter of column 1 
would pass to the top of column 2 ; the final 2 letters of column 2 would pass to the top of column 
3; the final 3 letters of column 3 would pass to the top of column 4; the final 4 letters of columns 

4, 5, 6, 7, and 8 would pass to the top of columns 5, 6, 7, 8, and 9; the final 3 letters of column 
9 would pass to the top of column 10; the final 2 letters of column 10 would pass to the top of 
column 11 ; and the final letter of column 11 would pass to the top of column 12. The results of 
the foregoing reasoning are embodied in the matrix or diagram shown in figure 9. 



1 2 3 4 5 6 7 8 9 10 11 12 




FlGtrEE 9. 



d. Now the capital letters in this matrix or diagram, which is often called a crown or hat 
diagram, 3 figure 9, represent the latters which are in the columns in case the first hypothesis 
(key numbers 9, 10, 11, 12 at the extreme right) is true. The capital letters above the heavy 
black line together with the lower-case letters at the top of the diagram represent the letters 
which are in the columns in case the second hypothesis (key numbers 1, 2, 3, 4 at the extreme 
right) is true. Therefore, since the hat diagram covers the two possible extremes with reference 
to the positions occupied by the short columns and embraces all possible intermediate conditions 
by showing what letters may be in the respective columns under any possible arrangement of long 

8 Because the lower-case letters at the top form what is usually called the crown or hat. 
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aDd short columns, the hat diagram, is applicable to any possible numerical key for the cryptogram 
in question and for the assumed width of rectangle. Therefore, in the anagrammirg process the 
hat diagram shows the maximum possible amount that any column may be shifted up or down 
in juxtaposing two columns to form digraphs of letters assumed to come from the same row 
in the plain-text rectangle. This is because all the letters of the first row of the actual enci- 
phering rectangle will be found in rows 1 to 5, inclusive, of figure 9; all the letters of the second 
row of the rectangle will be found in row's 2 to 6, inclusive, and so on, as indicated by the braces 
at the right in figure 9. 

e. Thus there arises the following important principle: Designating the number of short 
columns in a specific diagram by n, only such letters as fall within (n + 1) consecutive rows, will 
be letters that may have appeared in the same row in the actual transposition rectangle. Or, 
another way of stating the principle is this: Both members of any pair of letters actually in the 
same row in the transposition rectangle will be found only among the letters appearing in (n+l) 
consecutive rows in the correct hat diagram. In the case under discussion, if the first letter 
of such a pair is located in row 8, for example, the other letter cannot be in rov r s 1, 2, 3, or 13 to 
23 of figure 9. 

f. The usefulness of this principle in connection with the construction and employment of 
the hat diagram will soon become apparent. For example, again referring to figure 9, take the 
letter Q in row 19, column 7 ; it must be followed by a U in the plain text. There are 4 U’s in the 
message: they are in row 13 column 11, row 14 column 3, row 17 column 1, and row 20 column 6. 
Now the question is, can any of these 4 U’s follow the U, or may one or more of them be eliminated 
from consideration at once? Since the U’s in rows 13 and 14 fall outside the 4 consecutive rows 
above that in which the U is located, it follows that neither one of these U’s can be the one that 
succeeds the U. Thus two candidates are automatically eliminated from consideration. The U 
in row 17 and the U in row 20 are both possible candidates. 

14. Solution of example. — a. With the foregoing preliminaries out of the way, the solution 
of the cryptogram can now be carried forward with rapid progress. It has been indicated that 
the Q in row 19, column 7 (fig. 9), may be combined with either the U in row 17 column 1, or the 
U in row 20 column 6. Suppose the columns of figure 9 are now cut apart for ease in anagramming. 
Juxtaposing the indicated columns yields what is shown in figure 10. Since the combination 
shown at a in figure 10 involves column 1, it obviously begins with the letter 0 and ends with the 
letter A or L; no other letters can be added to this column. Since column 7 is already the maxi- 
mum length this column can be under any circumstances, no letters can be added to it at the 
bottom. Therefore, all the digraphs possible to form by juxtaposing these two columns are 
indicated in figure 10a. There are only 17 digraphs in all, whereas there should be at least 18. 
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Figure 10. 

Hence, combination 7-1 is impossible, and combination 7-6 is the only one that needs to be 
considered further. There are many excellent digraphs in it, and only one which admittedly 
looks rather bad, the H X. Seeing the digraphs K B and K S in these columns, a good assumption 
to make is that the K’s are preceded by the letter C. Is there a column with 2 C’s in approximately 
the correct region? Column 4 meets this requirement. Note the excellent trigraphs it yields, 
as shown in figure 10c. It now becomes fairly easy to add columns to this nucleus. For instance,’ 
the trigraph R Y B suggests a word ending in R Y, such as INFANTRY, ARTILLERY, CAVALRY; 
the trigraph MOV suggest MOVING; the trigraph C K B suggests the word ATTACK; followed by 
a word beginning with B, and so on. Trial of only a few columns soon yields what is shown in 
figure lOd, from which it soon becomes probable that the long columns end with column 12, since 
the letters after L Y yield an impossible sequence (E E E Y). Since it was originally assumed 
that there are only 4 short columns in the transposition rectangle, and since 4 columns have 
already been placed at the right (4-7-6-10), the rectangle, with the columns thus far placed, 
must be as shown in figure 10c. This, then, at once tells what the limits of columns 2, 3, 5, 8, 9, 
and 11 must be, and the rectangle can now be filled in without further delay. The completed 
rectangle is shown in figure 11. 
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b. The last step, recovering the literal key, is then taken. The key is to be found among 
the letters of the literal key reconstruction diagram in figure 12. 




Figure 12. 



The termination ATIONS seems a likely possibility. If this is correct, assignment of letters 
becomes modified as shown in figure 13: 




Figure 13. 



The word PENETRATIONS will fit and it is taken to be presumably correct. There is no absolute 
certainty about the matter, for it is conceivable and possible that there are other words which 
can be made to fit the sequence of key numbers given. 

15. Alternative method of solution, — a. The foregoing solution will no doubt appeal to the 
student as being straightforward and simple — if the original assumption as to the width of the 
transposition rectangle is correct. But, unfortunately, there is no way of knowing whether such 
an original assumption is correct until solution is well under way. In practice, of course, what 
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might be done within a well-organized cryptanalytic unit would be to divide up the work among 
the individuals constituting the unit, each being assigned one or more specific hypotheses to try 
out with respect to width of rectangle. Then one of these individuals would find the correct 
width and he would be joined by the others as soon as an entering wedge had been found in this 
way. Of, if the cryptanalyst is working alone, he must try out successive hypotheses as to 
width of rectangle until he hits upon the correct one. In making these hypotheses he must be 
guided by previous experience with enemy correspondence, which may afford clues as to minimum 
and maximum widths of rectangles. 

b. However, there is another method of attack which does not necessitate making any 
definite initial assumptions with respect to the width of the transposition rectangle. This method 
is a modification of the method set forth in the preceding paragraph. The text of the crypto- 
gram is written out columnwise on cross-section paper, every fifth letter being numbered for pur- 
poses of reference. Plenty of space is left between the columns, and about 10 or 15 letters at the 
bottom of each column are repeated at the top of the next column so that at any point in the 
transcription there will be in a single unbroken string at least one complete column of letters from 
the transposition rectangle. Then a section of consecutive letters of text is written on a separate 
strip of cross-section paper, columnwise of course, and by juxtaposing this strip against the whole 
text, sliding it to various points of coincidence against the text, an attempt is made to find that 
position in which the best digraphs are formed of the letters on the movable strip and the fixed 
sequence. Of course, if there is a Q in the cryptogram, the sliding-strip section is made to contain 
this letter, and the strip is then placed against the text where a U is found, so as to form the digraph 
QU. The digraphs formed above and below the QU are then studied; possibly a written record is 
made of the digraphs found. Then the same thing is done with the Q and all other U’s in the 
text, to insure that a correct start is made. It is this initial step which is likely to give the most 
difficulty (if there is anything difficult at all in the procedure) and it is important that it be cor- 
rect. If this first step is easy, then solution follows quite rapidly; if the cryptanalyst is unlucky 
and makes several false starts, the process is likely to be a slow one. In choosing from among 
several possible juxtapositions it may be advisable to calculate the probability value of each 
possibility by adding the logarithms of the frequency values of the digraphs, as explained in 
paragraph 7 g. In the absence of any Q’s in the text, recourse must be had to the formation of 
other probable digraphs, based upon the presence of certain other telltale low-frequency letters, 
such as C, H, J, K, V, and X. The cryptanalyst is fortunate if there are two or three of these low- 
frequency letters close to one another in a series of letters, for in this case he can search for a 
place where there are high-frequency letters (in a corresponding sequence) that might be com- 
bined with them. For example, suppose that a text shows a sequence . . . VEHHK . . .. 
A sequence such as. . . A R T C C . . . would be excellent to try, for it will yield the digrahhs 
AV, RE, TH, CH, CK. Or if there is a long sequence of consonants, the cryptanalyst should 
look for a correspondingly long sequence of vowels, since these make the best combinations and 
are therefore most probable. For these reasons it pays to study the text quite carefully before 
choosing a starting point, to find all such peculiar sequences as might be useful in affording a 
good point of departure. It should also be noted that there are at least two correct positions at 
which the sliding strip can be juxtaposed against the text, since in the enciphering rectangle the 
letters in one column form digraphs with the letters in the column not only on the right but also 
on the left. In the absence of any Q’s, or other low-frcquency letters suitable for a point of depar- 
ture, the very first 20 or 25 letters of the cryptogram may be used as the starting point, since 
these letters come from column 1 of the transposition rectangle and therefore there is no uncer- 
tainty at least as to the letter which is at the top of that column ; or, the last 20 or 25 letters of 
the cryptogram may be used as the starting point, since these letters come from the last-num- 
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bered column of the rectangle and therefore there is no uncertainty at least as to the letter which 
is at the bottom of that column. 

c. Suppose that a good initial juxtaposition has been found for the portion of the text that 
has been written on the sliding strip, and that a series of excellent digraphs has been brought to 
fight. The next step is, of course, to add to these digraphs on either 
side by finding sections of text that will yield “good” trigraphs and • • ... 

tetragraphs. For example, suppose that the initial juxtaposition has • • ... 

yielded what is shown in figure 14. The digraph P R suggests that it 
must be followed by a vowel, preferably E, A, or 0; the digraph A V 
might be part of the word CAVALRY, in which case it will be followed 
by A; the digraph C R suggests that it might be followed by the vowel 
A or E. A place is therefore sought, in the rest of the text, where 
there is a sequence of the letters here desired, and, of course, at the 
proper intervals. Suppose such a sequence is found and yields what is 
shown in figure 15. The skeletons of words are now beginning to 
appear. Assuming that A V A is indeed part of the word CAVALRY, 
there should be an L to follow it; the trigraph TIN suggests the ter- 
mination G; the trigrapli Z E R suggests the word ZERO. A section of 
text is therefore sought, which will have the letters L, G, and 0 in the 

1 2 3 4 6 1 2 

order L G . . 0. Enough has been shown to demonstrate 

the procedure. In the course of the work it soon becomes evident 
where the ends of columns are, because the digraphs above and below 
the nuclear or “good” portion become “bad” quite suddenly, just as 
soon as letters belonging to nonadjacent columns in the original rec- 
tangle are brought together. For example, in figure 15 it is observed that the trigraph at the 
top, R R S, is highly improbable, as is likewise the trigrapli at the bottom, E A 0. This suggests 
that these letters have been brought together erroneously, that is, that they do not belong in 
adjacent columns in the enciphering rectangle. If this is true then the “good” portion is com- 
posed of the 13 letters between these two extremities and therefore the columns arc about 13 
etters long. Additional work wall soon show exactly how long each column really is, and when 
this has been ascertained the problem has been practically completed, since at the same time 
that this becomes evident the sequence of columns has also become evident. 

d. An example of solution by this alternative method may be helpful. Using the crypto- 
gram of paragraph 13 as an example, figure 16 shows how the text might be transcribed on a sheet 
ol cross-section paper. Noting that the message contains a Q as the 129th letter, a section of 
text to include the Q is transcribed on a strip of cross-section paper and this strip is then juxta- 
posed against the remaining text to bring the Q in front of a U. How many letters should be 
included m this strip? The message contains 224 letters; if a width of say 10 to 20 columns is 
assumed, the columns of the rectangle will be about 12 to 22 letters in length. It will be safer to 
assume a convenient length closer to the maximum than to the minimum; consequently a length 
ot 20 letters will be tentatively assumed. Now the Q may be at the top of a column, at the middle, 
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Figure 14. 
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or at the bottom — there is no way of telling at this point. Hence, to make sure that nothing 
is overlooked, suppose a section of 41 letters is taken, with the Q at the center. There are 4 U s 
in the message, and 4 trials are to be made. The results are as indicated in figure 17-A. Examin- 
ing combination 1 in figure 17-A, the digraphs formed both above and below the Q U are not at all 

bad. In fact, not one of those above the Q U is impossible and the same 
is true of those below the Q U until the digraph V N is reached. Hence, 
combination 1 is possible. As for combination 2, this at once appears 
to be bad. Digraphs such as I I, and I H are highly improbable, and 
this combination may be discarded with safety. Combination 3 is 
possible from the top digraph, 0 F, to the 12th digraph below the Q U, 
although the digraph H X looks very bad. However, the X might be a 
sentence separator, so that this combination cannot be discarded. 
Combination 4 looks very improbable, with the digraph H N occurring 
twice, and other equally bad digraphs showing. Of the four possibil- 
ities then, combinations 2 and 4 are discarded, leaving 1 and 3 for 
further study. It is very difficult to choose between these two possi- 
bilities. All the digraphs in combination 1 down to digraph V N are 
possible; many of them are excellent. As for combination 3, all the 
digraphs down to V D are also possible and many of them are excellent. 
There does not seem to be much use to add the frequency values of the 
digraphs (or logarithms thereof) in each combination because it is hard 
to know with what digraphs to begin or end, although as a last resort 
this could of course be done. However, perhaps it is not essential that 
a choice be made at once; possibly jurther work along ^he lines now to 
be demonstrated will show which combination is correct. 

Noting the 2 K’s (in the digraphs K B and K S) among 
the combinations before the Q, assume that these K’s are 
parts of the digraph C K. Is there a sequence C . C in 
the text? There is but one such place, at the 63d letter. 

Suppose the corresponding section is placed in front of 
the combinations 1 and 3 of figure 17, as shown in figure 
17-B. It immediately becomes evident that combina- 
tion 3 is the correct one, for note the excellent tri- 
graphs it gives, as compared with those in combination 
1. Also note that the second trigraph below the E Q U 
in combination 3 consists of 3 E’s, indicating that the 
end of the columns has been reached just before this 
trigraph. As for the top trigraphs of figure 17-B they 
are good all the way up. But now the skeletons of 

„ _ ,.,. b B _ appear. The T H R immediately above the E Q U sug-^ 

gests either THREE or THROUGH; the FRO above the T H R suggests FROM or 
FRONT. Suppose the word REQUEST is assumed for the E Q U, and the word 
THREE is assumed for the T H R above it. This requires a section with 2 E’s in 
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words are 


beginning 



succession. _ . 

e. There are several such places in the text, and further limitation is advisable. 
The 8th trigraph from the top is certainly suggestive of the word MOVING, which 
requires an I to follow the V. Is there a place in the text where an I occurs 12 
letters before a succession of two E’s? There is one such place, and the corres- 
ponding section is juxtaposed at the proper place, yielding what is shown in 
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figure 17-C. The upper and lower limits of the columns are now fairly definite and are 
marked by the horizontal bars; tetragraphs E E E Y at the bottom and A M I E at the top 
are very improbable. The [tetragraph CEES below the top bar is possible, because it may 
represent the end of a word like FORCE followed by the beginning of the word ESTIMATED ; the 
tetragraph above the bottom bar suggests a word ending in E followed by the word IMMEDIATE. 
It seems hardly necessary to continue with the demonstration; in a few moments the entire 
diagram is reconstructed and yields the solution. During this process, as soon as a section of 
text in figure 16 has been used it is crossed off, so as to prevent its letters from being considered 
as further possibilities for addition to the reconstruction diagram. Thus, as the work progresses 
the number of available sections becomes progressively less, and the choice for successive sections 
for addition to the diagram becomes a quite easy matter. 

j. When two or three operators are assigned to work upon a cryptogram by this method, 
solution can be reached in a very short space of time, especially if each one of the operators takes a 
different point of attack. After a few minutes the fragments of texts obtained may be assim- 
ilated into one message which is then completed very speedily. 

g. This and the next four subparagraphs will be devoted to some remarks of a general nature 
concerning columnar transposition of the foregoing type. The degree of cryptographic security 
afforded by simple columnar transposition methods, especially when incompletely-filled ma- 
trices are employed, is considerably increased if some of the cells of the matrix are occupied by 
mills instead of significant letters. If nulls are employed judiciously their presence serves to 
confuse the cryptanalyst by introducing unusual digraphs, trigraphs, and polygraphs which 
may lead him to discard correct combinations of columns in the anagramming process and thus 
retard solution. Obviously, the use of low-frequency letters such as J, Q, X, or Z as nulls does 
not commend itself for this purpose, as such letters would not only distort the normal frequency 
distribution and thus give clues to the presence of nulls, but also they would be quickly 
“spotted” in the anagramming process. 

h. Another subterfuge, and a good one, to put stumbling blocks in the way of a quick 
solution is to leave “blanks” within the transposition matrix, that is, certain cells are left un- 
occupied by letters of the text. If only a few cells distributed irregularly within the columns 
of the transposition matrix are designated as blanks, the disturbing effect upon the anagram- 
ming process is quite marked. This more or less effectively hinders the cryptanalyst in his 
attempts to ascertain the lengths of the columns and considerably increases the difficulty of 
the anagramming process. 

i. In order to fix definitely the positions of the nulls or of the blanks in the transposition 
matrix, definite prearrangements between correspondents are necessary. These may be in the 
nature of “forms” outlining the matrix, showing the number of columns and the positions of the 
cells to be occupied by nulls, or of the cells to be left vacant in the inscription process; or the 
positions of these cells may be derived from the elements of the transposition key itself. If 
“forms” are employed, they may be used with varying transposition keys, so that even though 
there may be only relatively few different forms, the use of varying transposition keys serves to 
increase cryptographic security to a rather marked degree. 

j. If nulls, or blanks, or both, are distributed irregularly but symmetrically throughout the 
transposition matrix (as, for example, blanks are distributed in cross-word puzzles) solution 
of single messages produced by simple keyed -columnar transposition from such a matrix 
becomes an extremely difficult if not impossible problem. Naturally, if nulls and blanks' are 
distributed irregularly and assymmetrieally the matter becomes hopeless, as far as a single 
message is concerned. 

k. Of course, if several messages of identical length and in the same key are available for 
superimposition, the presence of the nulls or blanks then makes little difference, because the 
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general solution to be explained in a subsequent paragraph (par. 26) can be applied. Or if mes- 
sages with similar beginnings or similar endings are available, solution is facilitated here as in the 
simpler case where nulls or blanks are not employed, as will be explained in subsequent para- 
graphs (pars. 23-24). Considerations of space prevent going into detail in the solution of an 
example, and the student should undertake a study of these c&ses for himself. 

16. The C-»P and the P-»C sequences. — a. Two numerical sequences which constitute the , 
bases for several very important cryptanalytic operations and procedures in the solution of 
transposition ciphers may be derived from, and are applicable to, most ciphers of this class. They 
are as follows: 

(1) A sequence the successive terms of which indicate the position numbers that the : 
successive letters of the plain text occupy in the cipher text. This sequence will hereinafter be 
designated the plain->cipher sequence, or P-*C sequence. 

(2) A sequence the successive terms of which indicate the position numbers that the 
successive letters of the cipher text occupy in the plain text. This sequence will hereinafter be 
designated the cipher^plain sequence, or C— sequence. 

b. These two sequences are obviously related, one being the inverse or indexed version of the 
other. Given one of the sequences, the other can be derived from it by the simple operation of 
indexing, in a normal sequence, the positions occupied by the numbers constituting the sequence 

on hand. An example will be given presently. \ 

c. Note the encipherment shown in Figure 18-A. \ 



TRANSPOSITION 

12 9 1 4 10 8 6 11 2 13 3 7 5 

THEQUICKBROWN 

F0XJUMPS0VERT I 

HELAZYDOG 



Term No .1 2 3 4 5 6 7 8 9 10 11 12 13 14 IS 16 17 18 19 20 21 22 23 24 28 26 27 28 29 30 31 32 33 34 35 

Cipher.. E XLBOGOEQJANTCPDWRIMYHOEUUZKSOTFHRV 



Figure 18-A. 
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Now, if, instead of letters, the successive numbers 1, 2, 3, . . . are inscribed in the cells of the 
matrix, in normal order of writing, the “cipher text” becomes the P— »C sequence and is as 
follows: 

12 9 1 4 10 8 6 11 2 13 3 7 5 

01 02 03 04 05 06 07 08 09 10 11 12 13 

14 15 '16 17 18 19 20 21 22 23 24 25 26 

27 28 29 30 31 32 33 34 35 

Term number 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 18 17 18 19 20 

P~->C equences 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19 

21 22 23 24 25 28 27 28 29 30 31 32 33 34 35 

32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 

Figure 18-B. 

The student may easily verify that the P-»C sequence is what it purports to be by noting that, 
according to it, the 1st letter of the plain text of the illustrative message, T p , becomes the 31st 
letter of the cipher text (since the number 01 occupies position 31 in the P— >C sequence shown 

above), and that in the cryptogram the 31st letter is T c ; the 2d letter of the plain text, H p , becomes 

the 22d letter of the cipher text and that in the cryptogram the 22d letter is H c ; and so on. In 
connection with the P— »C sequence, it is to be noted that successive terms in the sequence, 
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in the case of single transposition, show a constant difference except when passing from a greater 
to a smaller number, which happens every time a transition is made from a term applying to 
the bottom element of one column to a term applying to the top element of the next column. 
For example, in the case of the 1st three terms in the sequence: 16—03 = 13; 29—16=13. 
However, in the case of the 3d term of the sequence (29) and the 4th (09) the passage is from 
a greater to a smaller number and the constant difference, 13, no longer is evident. The cause of 
the constant difference is, of course, obvious and follows directly from the mechanics of the trans- 
position system itself. The point to be specially noted is that the existence of such a constant 
difference (with the exceptions noted above) may be taken as one of the identifying characteristics 
of single columnar transposition; double columnar transposition or other types of complex trans- 
position will show no such constant difference throughout the P->C sequence. 

d. Given the P— »C sequence in subparagraph c, its inverse, the C— »P sequence is established 
merely by preparing an indexed version of the former. Thus: 



Term number 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 

P-^C sequence 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 06 19 

21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 

Term number 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 

C-*P sequence 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 

21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 



e. The C-»P sequence can also be produced in another way. Suppose that numbers are 
inscribed in the cells of the transposition matrix, not in the normal manner of writing from left to 
right and form the top downward, but according to the route followed in transcribing the numbers 
to form the “cipher text,” that is, in key-number order in the columns of the matrix. Thus: 

12 9 1 4 10 8 6 11 2 13 3 7 5 

31 22 01 09 25 19 14 28 04 34 07 17 12 

32 23 02 10 26 20 15 29 05 35 08 18 13 

33 24 03 11 27 21 16 30 06 

Figure 18-C. 

If these numbers are now transcribed according to the normal manner of writing (from left to 
right and from the top downward), the sequence produced is 31 22 01 09 25 . . ., which coin- 
cides with the C-»P sequence shown in subparagraph d above, which in turn was derived from the 
P->C sequence. 



Term number 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 

C-riP sequence 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 



21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 

29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 
j. The C-*P sequence may also be called the anagram sequence because it can be established 
as a result of a solution accomplished by anagramming superimposed messages of identical length. 
It is clear that what is accomplished in such a solution is to rearrange the letters of the cipher 
text to bring them back into their original order in the cipher text, that is, the solution involves a 
C->P conversion. 

g. The P^>C sequence is called by a recent French author the up sequence (from the Greek 
word kryptos ) because it gives the order of the plain-text letters as they occur in the cryptogram. 
The P— sequence is also termed the encipher sequence by another writer, and still another has 
called it the transposition sequence. The present author believes that the terminology adopted 
herein, viz, P-»C sequence and C-*P sequence, is less confusing and serves more accurately to 
identify or characterize these sequences than the other designations herein indicated. 
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i h. The term number is useful merely to facilitate finding and referring to specific terms or 

; | numbers in a sequence, whether the latter be a C— >P or a P — >C sequence. The number simply 

indicates the locus or position a term occupies in the sequence. In connection with a plain- 
text message the consecutive term numbers 1 , 2, 3, . . . may be used as loci for the successive 

letters of the message; in connection with a cryptogram the consecutive term numbers 1, 2, 3, 
... may be used as loci for the successive letters of the cipher text. 

i. In single, keyed-columnar transposition an interesting relationship exists between sections 
of the C-»P sequence. Consider the C— »P sequence given in subparagraph d above, and note 
that by adding the integer 1 to the successive numbers thereof, sections of the original sequence 
show certain identities with sections in C— >P sequence + 1 . Thus: 

Term number 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 

C-VP sequence.. 31 22 01 09 25 19 14 28 04 34 07 17 12 32 23 02 10 26 20 15 29 05 

C -»P sequence + 1 — 32 23 02 10 26 20 15 29 05 35 08 18 13 33 24 03 11 27 21 16 30 06 

f 23 24 26 26 27 28 29 30 31 32 33 34 35 

35 08 18 13 33 24 03 11 27 21 16 30 06 

36 09 19 14 34 25 04 12 28 22 17 31 07 

In fact, if the successive numbers of the C->P sequence are set down in rows to produce sequent 
numbers in columns, the following interesting diagram is obtained: 

31 22 01 09 25 19 14 28 04 34 07 17 12 

+ 1 32 23 02 10 26 20 15 29 05 35 08 18 13 

+ 1 33 24 03 11 27 21 16 30 06 

Figure 18-D. 

Reference to figure 18-C will show the identity of this diagram with that figure. Such an 
arrangement of course indicates at once the number of columns in the transposition rectangle, 
from which it follows that if the C->P sequence is available it is an easy matter to establish the 
outlines of the transposition matrix. The phenomena dealt with in this subparagraph are but 
a reflection of those discussed in subparagraph c above. 

: | j. The phenomena just indicated may, however, be employed to advantage in another 

- manner in the solution of an unknown example. Referring to the illustrative cryptogram in 

: f subparagraph c above, suppose that the cryptanalyst has reason to suspect the presence of the 

| probable word QUICK. The letters necessary to produce this word (and their term numbers in 

1 ! the cryptogram) are as follows: 

[ 25 

I: 9 26 19 14 28 

f ! QUICK 

! The sequence 9-^5-19-14-28 now constitutes a portion of the C->P sequence. Adding the 

»: it integer 1 successively to these C-»P numbers, let the corresponding letters be set down along- 

> I side the numbers. Thus: 
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Here it will be seen that portions of “good” plain text become manifest, viz, JUMPS and AZYD0 . 
The 3d derivative no longer is “good” because the rectangle has but 3 rows and consequently 
only the 1st and 2d derivatives from the “base” are valid. It is obvious that the foregoing 
method of deriving plain-text sections from a correct probable word offers considerable possi- 
bilities as a cryptanalytic tool, especially in the case of matrices with more than 2 or 3 rows. If 
sections of text can be reconstructed in this manner and then combined in proper sequence the 
reconstruction of the complete matrix and the transposition key is a relatively simple matter. 
The application of the foregoing principle to the solution of unknown examples is, of course, 
obvious. 

k. There is also an interesting relationship between the sections of the P— »C sequence for a 
cryptogram, though it is somewhat different from that discussed is subparagraphs i and j in the 
case of the C-»P sequence. Consider the P— >C sequence set forth in subparagraph d above and 
note how, by adding the integer 1 to the successive numbers, sections of the P-*C sequence become 
identical with sections of the P— »C + 1 sequence. Thus: 

P-*C sequence. 03 16 29 09 22 35 11 24 04 17 30 13 26 07 20 33 12 25 

1 2 3 4 5 6 7 

06 19 32 02 15 28 05 18 31 08 21 34 01 14 27 10 23 

8 9 10 11 12 13 

P->C sequence + 1 04 17 30 10 23 36 12 25 05 18 31 14 27 08 21 34 13 26 07 

1=4 2=13 3=7 4 = 10 5=12 6=11 7=5 

20 33 03 16 29 06 19 32 09 22 35 02 15 28 11 24 

8=6 9=1 10=8 11=2 12=9 13=3 

The equivalencies between identities, as indicated above, indicate not only that the enciphering 
matrix has 13 columns, but also they may be used to establish the actual transposition key or 
at least a cyclic permutation of the key, by constructing a chain of equivalents. Thus: 

1=4, 4=10, 10=8, 8=6, 6=11, 11=2, 2=13, 13=3, 3 = 7, 7=5, 5=12, 12=9, 9 = 1 
This yields, by eliminating the term common to successive equivalents, the following chain or 
transposition key: 

1 4 10 8 6 11 2 13 3 7 5 12 9 

Reference to figure 18-A will show that the foregoing key is a cyclic permutation of the actual key. 

l. There remain only some minor remarks which, being of a general nature arising from the 
mechanics of simple keyed-columnar transposition, are worth noting. They are discussed in the 
subsequent two subparagraphs. 

m. An appreciation of the difficulties introduced by employing only incompletely-filled 
rectangles indicates that it would be very useful if there were some method whereby in the initial 
stages of solution the cipher text could be divided up correctly into its component long and short 
columns, for the subsequent steps of rearranging the columns by the anagramming principle are 
quite simple. If, for example, there were some feature which provided a means of ascertaining 
when in encipherment a transit was made from the bottom of one column to the top of the next 
column, then the location of these transition points or “breaks” would obviously permit of break- 
ing up the cipher text into its correct long and short columns. In later studies cases of this kind 
will be encountered. 

n. It is useful sometimes to be able to ascertain just where breaks cannot occur, that is, 
where a passage from the bottom of one column to the top of the next one cannot occur in the 
cipher text, for this will limit the field for experiment. A consideration of the mechanics of the 
system will afford an excellent clue to the fact that this determination is easy to make. In any 
transposition rectangle involving simple keyed-columnar transposition the interval, in the cipher 
text, between two consecutive letters which are in the same row in the matrix is the sum of a 
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multiple of the length of the short columns and a multiple of the length of the long columns. For 
example, consider the adjacent letters C K in the plain-text rectangle in figure 18-A. In the cipher, 
C c is the 14th letter, K c is the 28th and the interval is 28—14=14. The message has a total of 
35 letters and the matrix has 13 columns, 9 long ones of 3 letters and 4 short ones of 2 letters. 
An interval of 14 can therefore be brought about in only one way: (4X3) + (1X2)=14, which 
means that 4 long columns and 1 short one intervene between the C and the K in the plain text, 
and that the key numbers applicable to the two columns are 5 apart in sequence, that is, if the 
column in which C is located has key number 1, the column next to it on the right is 6, or if the 
former is 2 the latter is 7, and so on. Reference to figure 18-A will show that these deductions 
are correct and that the key numbers involved are 6-11. However, a m ore general treatment is 
possible. Given a cryptogram of 26 letters and an assumed 
width of 6 columns, for example, the matrix can have only 2 
columns of 5 letters and 4 columns of 4 letters. Setting down 
the multiples of the two lengths in tabular form, for conven- 
ience, the following is obtained: 
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5 4 

0 multiple 0 0 

1st multiple 5 4 

2d multiple 10 8 

3d multiple — 12 

4th multiple — 16 

All the possible positions of breaks in the cipher text, that is, transits from the bottom of one 
column to the top of the next column, may now readily bo ascertained by finding the totals result- 
ing from making all the possible combinations of the indicated multiples taken in pairs. It is 
convenient to draw up a table to show directly the sums of the combinations. Thus: 
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If, now, diagonal lines are drawn from the lower left-hand corner to the upper right-hand corner 
of the diagram, the locations of all possible breaks are given. Thus, there can be a break be- 
tween the 4th and 5th letters (passing from a short column to the next column, which may be 
long or short, of course); there cannot be a break between the 5th and 6th letters, nor between 
the 6th and 7th, nor between the 7th and 8th; there can be a break between the 8th and 9th, as 
well as between the 9th and 10th, but not between the 10th and 11th, and so on. Suppose that 
for one reason or another the cryptanalyst has good reason to suspect that a break occurs imme- 
diately after the 13th letter. This means that there are 2 short columns (of 4 letters) and 1 long 
column (of 5 letters) up to that break. The diagram shows that there remain only 2 short 
columns and 1 long one, and the only breaks that are possible beyond the one at the 13th letter 
are: Between the 17th and 18th, or between the 21st and 22d letters. 

o. The importance of the various principles set forth in this paragraph will become evident as 
the student progresses in his studies of transposition ciphers. 



Section IV 



OPPORTUNITIES AFFORDED BY STUDYING ERRORS AND BLUNDERS MADE BY 

ENEMY CRYPTOGRAPHERS 

Paragraph 



Importance of the study of errors and blunders in early work upon an unknown system 17 

Significance of terms “special solution” and “general solution” 18 

Examples to be studied 19 




17. Importance of the study of errors and blunders in early work upon an unknown 
system. — a. Blunders and mistakes made by cryptographic clerks in the execution of cryp- 
tographic clerks in the execution of cryptographic instructions should be rare in a well-trained and 
well-disciplined cryptographic service. Nevertheless, blunders and mistakes are committed 
despite all that can be done to prevent their occurrence. Especially in the excitement prior to 
or during an important action or movement do such instances take place and these afford golden 
opportunities for the enemy cryptanalytic service. This situation exists in respect to all types of 
cryptographic systems and no cryptanalytic instruction would be complete if cognizance were not 
taken of the advantages which may be reaped from the blunders, the mistakes, and, occasionally, 
the downright ineptitude of the adversary’s cryptographers. 

b. Practically every cryptographic system affords opportunities for the commission of errors 
in its application, and each system more or less presents a separate case. That is, the errors which 
may be made in one type of cryptographic system may be peculiar to that type alone and to no 
other type; hence, the astute cryptanalyst is constantly on the lookout for instances of crypto- 
grams containing the specific type of error by which that system is handicapped. Furthermore, 
the general types of blunders or errors that may be committed are nearly as numerous as are the 
general types of cryptographic systems, so that no complete list of such as may be encountered in 
practice can be drawn up. 

c. After the cryptanalyst has by painstaking and more or less arduous labors solved a system 
and has become thoroughly familiar with its mechanics, he should carefully review the details of 
the mechanics to learn what things can go wrong, what sorts of mistakes the enemy cryptographic 
personnel are likely to make, and then study the external manifestations of these aberrations so that he * 
may be able to recognize instances of their occurrence in subsequent cryptograms. This sort of study 
has no value in itself particularly; its importance lies in the fact that the effects of erroneous 
treatment may lead to very rapid solution or to quick recovery of keys to subsequent messages. 

d. When an unknown system is under investigation and the cryptanalyst is striving to ascer- 
tain just how it operates (which is often the most difficult step in solution), a study of the crypto- 
grams representing corrections to previous messages containing errors is a most fruitful source of 
data. Indeed, at times this sort of intensive study will yield clues for solving a system which 
might otherwise resist all efforts to break it down for a very long time. 

18. Significance of terms “special solution” and “general solution.” — a. Now the importance 
of the comments made in the foregoing paragraph will be clear if it is noted that a study of the 
blunders and errors often leads to the elaboration of methods for the rapid breaking down of 
cryptographic systems. But it must also be realized that in some cases no blunders or errors are 
essential to a rapid solution of the type alluded to above. Sometimes the very mechanics of 

( 37 ) 
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the system itself are such that unavoidable or unpredictable circumstances arise so that special 
solutions become possible. The latter term calls for a bit of explanation. 

b. When the circumstances surrounding a specific cryptogram or set of cryptograms are such 
as to present peculiar or unusual conditions that make a solution possible when in the absence of 
these conditions solution is either impossible or improbable, the methods employed in reaching a 
solution in such cases constitute what is commonly termed a special solution. Some examples 
will be demonstrated very soon. Systems of which this may be true are, of course, cryptographi- 
cally weak but it may be observed that it is perhaps impossible to devise a system which may be 
considered to be absolutely free from this source of weakness. 

c. The advantages of a special solution for any type of cryptographic system are, as a rule, 
two in number. First, it often makes a solution possible when otherwise this might not be the 
case. Secondly, if often affords a method of achieving a very rapid solution in the case of a 
problem which otherwise might require a long time. But a special solution presents one basic 
disadvantage: It is by its very nature dependent upon the existence of unusual circumstances; in 
other words, upon chance or good fortune bringing about a set of circumstances favorable for a 
solution. When these unusual conditions or circumstances do not obtain, then solution may be 
impossible. Therefore, it is desirable to have, if possible, for every type of system a more or less 
general solution which may be applied in the absence of the unusual conditions necessary for the 
application of a special solution. In other words, a general solution in cryptanalysis implies a 
method or procedure which if applied in ordinary cases and under normal conditions will yield 
the solution. However, the term general solution in cryptanalysis must not be taken too literally. 
The situation in cryptanalysis is not exactly analogous to that which obtains in the field of pure 
mathematics, for the circumstances are often quite different in the two sciences. A general 
solution in mathematics is expected to, and will, solve every case that falls within its province; 
a general solution in cryptanalysis is likewise intended to solve every case that falls within its 
province but this usually partakes more of the nature of a prayer or hope than an expectation. 
Much depends upon the amount of traffic available for study, the length of individual crypto- 
grams, and the indefinable element called luck, that is, a set of fortuitous circumstances which 
happen to make a solution easy or difficult, such as the presence of many or exceptionally long 
repetitions, etc. Furthermore, whereas in mathematics a general solution prescribes the exact 
steps to be followed in arriving at the solution and the latter can be applied in all instances 
without variation or deviation from a fixed procedure, in cryptanalysis a general solution merely 
outlines a broad path that may be followed in order to arrive at a solution. Application of a 
general solution in cryptanalysis in specific instances may involve minor detours to circumvent 
unexpected obstacles, or it may involve quite large changes or modifications in the general 
procedure. 

19. Examples to be studied. — a. As stated above in paragraph 17, a complete list of the 
specific blunders that cryptographic clerks are prone to perpetrate cannot be drawn up. Certain 
of them may be described in general terms and examples given of some which have already been 
encountered in this and in preceding texts. Commonly it is the case that these blunders do not 
become evident until two or more cryptograms are available for comparison. One of the most 
frequent sources of circumstances leading to the transmission of cryptograms affording rich 
material for cryptanalytic. comparison is the following: A cryptographic clerk prepares a crypto- 
gram, in the course of which he makes a mistake of such a nature as to render the cryptogram 
difficult or impossible to decipher by the cryptographic clerk serving the addressee. A request 
for repetition ensues, whereupon the enciphering clerk reexamines his original work and finds that 
he has made a mistake. He then commits the grave blunder of reenciphering the identical message 
(without paraphrasing) and transmitting what to the enemy cryptanalysts is obviously a second 




m 




version of the original message. The consequences are often fatal to cryptographic security. 
The least that can happen is that the key for this particular message may be disclosed very 
quickly; more serious, the basic or primary elements for the entire day’s traffic may be wrested 
from the blunder; but most serious are the consequences if it happens that the blunder has been 
committed immediately or soon after a new cryptographic system has been instituted and the 
enemy cryptanalysts are exerting strenuous efforts to learn its mechanics, for then is when the 
information to be gained is most valuable. 

b. In his previous studies the student has observed the many opportunities for quick 
cryptanalytic success afforded by enemy addiction to the use of stereotypic phraseology, espe- 
cially at the beginnings and endings of messages. Stereotypic phraseology affords even more 
golden opportunities for cryptanalytic success in the case of transposition systems than it does 
in the case of substitution systems. 

c. In the next few paragraphs some specific examples of the consequences of cryptographic 
blunders and ineptitude in the case of transposition systems will be studied. These are intended 
to give the student some idea of the far-reaching effects such studies may have. It is important 
that he grasp the fundamental principles, for they will enable him to develop for himself the 
methods that he may find necessary in practical work. Incidentally, it may be added that the 
student should not get the idea that these instances are purely theoretical. It is sometimes almost 
unbelievable that cryptographic clerks with any common sense would perpetrate the stupid 
blunders that they do occasionally commit. 
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Section V 

SPECIAL SOLUTIONS FOR TRANSPOSITION CIPHERS 

Paragraph 



Solution when the beginning or end of the plain text is known 20 

The case of an omitted column 21 

The case of an interchanged pair of columns 22 

Messages with similar beginnings... - — 23 

Messages with similar endings 24 

The solution of a single message containing a long repetition 25 

Solution when several cryptograms of identical length and in the same key are available 26 

Reconstruction of the keys in double transposition 27 

Special cases of solution of double transposition ciphers — - 28 



20. Solution when the beginning or end of the plain text is known. — a. It often happens, 
when correspondents have fallen into the bad habit of sending stereotyped communications, 
that the beginnings or the endings of messages become so fixed in their form and content that 
the enemy can with a fair degree of certainty guess what these will be in specific cases. If so, 
a quick solution can be reached, the key reconstructed for one message, and this will, of course, 
enable him to read all other messages in the same key. This is particularly true of simple, 
keyed-columnar-transposition ciphers. It is only necessary that the cryptanalyst cut the text 
up in such a manner as to bring the letters composing the assumed text all within tire same row* 
or rows of the transposition rectangle. 

b. Suppose that the enemy frequently uses the introductory expression REFERRING TO YOUR 
NUMBER. Here is a cryptogram assumed to begin with this phrase: 

Cryptogram 

IMAOD RMGRN ERNIN TUSFS DRYEP BRCFT 

OIRNW TMOIS 0IEGE DHOPN CHLFU ESEPQ 

ERIAR UHIAG PAU00 SSSCI ONRRE 0V0EY 

EMEVG TRIAF HTEPB NBTNE AEETA 

c. Assuming that previous experience has indicated that the enemy uses keys varying 
from 10 to 20 letters in length, the arrangement of the letters in the tops of columns under a 
key length of 10 would be as shown in Fig. 20. 

123466789 10 

REFERRINGT 

0Y0URNUMBE 

R 

Figure 20. 

The first group of the cryptogram begins with I M. The arrangement shown above gives I U 
as the top of a column; hence a key length of 10 is not correct. A key length of 1 1 is then tried. 

123466789 10 11 

REFERRINGT0 

Y0URNUMBER 

Figure 21. 
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Here a column is headed by I M, so that this is a possible arrangement. If the width of the 
rectangle is 11, its outlines are as shown in figure 22. There are 5 columns of 11 letters and 6 




Figure 22. 



columns of 10 letters. The text can now be marked off into sections of proper lengths and, more- 
over, guided by the letters which must be at the heads of columns, the text can be inscribed in 
he rectangle m key order. For example, column 1 must end with the second group, RMGRN- 
column 2 therefore begins with E R. There is only one possibility, viz, the fourth column! 
ihis is a long column, and must therefore have 11 letters, making column 3 begin with R Y. 
ibis definitely fixes the position of the number 3 in the key, and so on. The solution is reached 
alter only a very few moments and is as shown in figure 23. 
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Figure 23. 



d. The same general principles, modified to suit the circumstances, may be followed in the 
case involving known or suspected endings of messages. The probable words are written out 
according to various assumed key lengths and the superimposed letters falling at the bottoms 
of columns are sought in the cryptogram. 

21. The case of an omitted column.— a. Sometimes a very careless clerk omits a column in 
transcribing the text from the enciphering rectangle and fails to check the number of letters in 
the final cryptogram. Obviously such a cryptogram will be difficult if not impossible to decipher 
at the other end, and a repetition is requested and sent. If now the identical plain text is en- 
ciphered correctly, two cryptograms are at hand for comparison. This will disclose the length 
of one column, which can be assumed to be either a long one or a short one. The position, in 
the correct cryptogram, of the column omitted from the incorrect one will often afford direct 
clues as to the exact dimensions of the enciphering rectangle. For example, suppose the crypto- 
gram in paragraph 206 had first been transmitted as follows: 

Cryptogbam 



I M A 0 D 
I E G E D 
A U 0 0 S 
T E P B N 



RMGRN 
H 0 P N C 
S S C I 0 
B T N E A 



R Y E P B 
HLFUE 
N R R E 0 
E E T A 



R C F T 0 
S E P Q E 
V 0 E Y E 



I R N W T 
R I A R U 
MEVGT 



M 0 I S 0 
H I A G P 
R I A F H 



b. The column which was omitted is E RNINTUSFS D, and falls between columns 
1 and 3. Since the omitted column contains 11 letters and column 1 contains 10, the dimensions 
of the rectangle immediately become known. Thus, uncertainties as to the dimensions of the 
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rectangle are dissolved and a large step forward has been made in the solution. Also, the 
general whereabouts of columns 1 and 2 are now known, since the former is a short one, the 
latter a long one. 

22. The case of an interchanged pair of columns. — a. The keying element in the case of 
columnar transposition is simply a practical means of controlling the order in which the columns 
of the enciphering rectangle are transcribed in forming the cipher text. Commonly this numerical 
key is derived from a literal key. Suppose that a cryptographic clerk makes a mistake in the 
latter step. For example, suppose that the literal key is ADMIRATION and that as a result of a 
slight relaxation in attention he assigns the number 5 to the letter N and the number 6 to the 
letter M. A pair of columns will become interchanged as regards their order of selection in the 
transcription process, and likely as not a repetition will be requested by the addressee. If a 
second version is sent, enciphered by the correct key, a comparison of the two versions will dis- 
close the width of the enciphering rectangle and possibly the general position (left or right) of 
the columns that were interchanged. 

b. An example will serve to make the matter clear. Assume the two cryptograms to be as 
follows: 

First Version 



0 D N I L 

1 N E N E 

0 0 C 0 0 



N T T H D 
N F U E H 
R 0 G I 0 



G S 0 H A 
RWRRI 
S 



00QSG TERPS 
RATPE DETAN 



Second Version 



0 D N I L 
U E H R W 
0 0 C 0 0 



N T T H D 
R P S I N 
R 0 G I 0 



G S 0 H A 
E N E R I 
S 



0 0 Q S G 
RATPE 



T E R N F 
D E T A N 



c. The two cryptograms are superimposed as shown in figure 24 and their points of similarity 
and difference noted. 



First version.. ODNILNTTHDGSOHAOOQSGTE R[P S I N E N E) 

Second version. ODNILNTTHDGSOHAOOQSGTE R[N F U E H R W 

[N F U E H R W R]R I R A T P E D E T A N 0 0 C 0 0 R 0 G I 0 S 

R]P S I N E N E]R IRATPEDETAN00C00R0GI0S 

Figubk 24 



d. The two versions are alike except for a pair of interchanged sequences; the bracketed 
sequence PSINENEin the first version is matched by the same sequence in the second 
version, but at a different position in the message; likewise the bracketed sequence 
NFUEHRWRin the first version is matched by a similar sequence in the second version, 
but at a different position in the message. The various deductions which can be made from the 
situation will now be set forth. 

e. One of these sequences contains 7 letters, the other contains 8. It follows that the col- 
umns of the enciphering rectangle are probably 7 and 8 letters in length; hence, with 61 letters, 
the width of the matrix is 8. Since there are 23 letters from the beginning of the messages to the 
first point of their difference, it follows that there are 2 columns of 8 letters and 1 column of 7 
letters involved in this section [(2X8) + (1 X7) = 23], and that the error made in encipherment 
does not involve columns 1, 2, or 3, which are therefore properly placed in the first version. Since 
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the sequences which are interchanged are consecutive in the text it means that the numbers 4 
and 5 were interchanged in the key for the first version. Since one of these sequences is of 7 
letters, the other of 8 letters, one of the numbers, 4 or 5, applies to a long column, the other, to 
a short column. Since the second version is presumably the correct version, and since in the 
second version the 8-letter sequence comes first, the key number 4 applies to a long column, the 
key number 5 to a short column in the correct version. With the foregoing deductions in mind, 
the solution and the reconstruction of the numerical key becomes a simple matter. 

/. The text of the correct version is written out as seen in figure 25a. Seeing a Q in column 3 
and a U in column 4, these two columns are made adjacent by sliding column 3 one interval down- 
ward, as shown in figure 25b. In the latter, column 7 has also been placed at the second interval 
to the right of column 5, because the latter yields good trigraphs with columns 3-4. Seeing the 
trigraph T R 0 near the bottom of columns 3-4-5 and the letters 0 and P in the same row, sug- 
gests the word TROOP. The columns are to be rearranged to make this word TROOP. There are 
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Figure 25. 

two columns which have an 0 in the proper row, columns 2 and 8. The trial of combination 
3 -4-5-8 -6, while producing TROOP in the proper row, gives bad pentagraphs in the other rows; 
but the combination 3-4-5-2-6 shows excellent pentagraphs, as will be seen in figure 25c. The 
words SQUADRON and HOSTILE are clearly evident; the completion of the rectangle is now a 
very simple matter. The result is shown in figure 25 d. The recovery of the numerical key now 
will enable other cryptograms to be read directly. 

23. Messages with similar beginnings. — a. In military correspondence it is often the case 
that somewhat similar instructions or information must be conveyed by a superior commander 
to several subordinate commanders simultaneously. Such a situation frequently results in the 
circumstance that two or more cryptograms addressed to different stations will begin with exactly 
the same words. When simple columnar transposition is the system used for encipherment, 
then it will result, in such cases as the foregoing, that the first two or more rows of the transposi- 
tion rectangle will be identical in the messages which begin alike. Therefore, the cryptograms 
will show identical sequences of two or more letters, distributed throughout the texts and by 
studying these identities the cryptanalyst is able at once not only to ascertain the width of the 
rectangle but also to divide up the cipher text into sections corresponding with the exact columns 
of the rectangle, thus eliminating the only real difficulty in solution, viz, the determination of 
which are the long columns, which the short. An example will demonstrate the short cut to 
solution which such a situation provides. 

b. Here are two cryptograms which are assumed to have been intercepted within a few min- 
utes of each other, the messages being addressed to two battalion commanders by the regimental 
commander. 
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Cryptogram 1 



B N T S E A 
0 T 0 K M S 
0 F G T F C 
A R P A T 0 



R K C L C E 
Z T G N Y I 
T 0 T D N I 
U T I 0 B I 



T T N BITE 
TDK LANA 
NOE ff X E R 
E 0 A GAAP 



R R 0 T A E 

E F T F S N 

F A S I 0 S 

N E I K 



L T N N 0 
P G N P A 
T I D R R 



N N E N 0 
R W 0 I A 
R M M A 0 



Cryptogram 2 



B N T S E 
I I U T 0 
W 0 A R 0 
0 C M M A 



I N D 0 T 
K M F E Y 
E E K T F 
0 0 S C A 



LCETS AFPLE RROMO ISOEN 
KPCYI TDVSI NTAEF TFSTO 
CTTLT AEANO EWXPV TITIO 
NROUT IEELS 0 A G A A ABITR 



N 0 N S T 
N T N A R 
S T T T F 
T 



c. The cryptanalyst, noting the similarities in the first few letters of the two messages, care- 
fully compares the two texts, looking for additional identical sequences of letters between the 
cryptograms. For example, No. 1 begins with B N T S E and so does No. 2; after an interval 
of 4 letters in No. 1 and 5 letters in No. 2 he notes the identical sequences L C E T; after an 
interval of 5 letters in No. 1 and 5 letters in No. 2 he notes the identical sequences E R R 0, 
and so on. The identities are underlined or marked in some distinctive manner throughout the 
texts, as shown in figure 26. 
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Cryptogram 2 
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Figure 26. 

d. Now it is obvious that these identities exist because the two messages begin alike, and 
by taking advantage of the identical portions in the cryptograms it will be possible to transcribe 
the texts of the latter into transposition rectangles which will not only have the identical por- 
tions in homologous positions, but also will show which are long columns, which are short. 
All that is necessary is to begin transcribing the texts on cross-section paper, in columns, arranging 
matters so that the identical sequences will fall at the tops of the columns. Thus, the first 
column of No. 1 will contain the letters B N T S E A R K C and the first column of No. 2 will 
contain the letters B N T S E I N D 0 T; the second column of No. 1 will contain the letters 
L C E T T N B I T and the second column of No. 2will contain the letters L C E T S A F P L, 
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and so on. It appears that the identical portion embraces the first four rows of the rectangle and 
runs over a number of letters on the fifth row. This is because the identical sequences consist 
of 4 an d 5 letters. Figure 27 a shows the identities between the first 5 columns of the two trans- 
position rectangles. Only once in the case of this particular example does any uncertainty arise 
as to exactly where an identical sequence begins or ends, and that is in connection with the 
seventh pair of identities, involving the series of letters A E F T F S N P G N P in No. 1, and 
r A E F T F S T 0 N T N in No. 2. These sequences contain 6 identical letters, but even here 

the uncertainty is of only a moment’s duration: The initial letter A does not belong to the iden- 
| [,; tical portions at the top of the transposition rectangle because the A’s are needed to complete 

i j columns 6 in both rectangles. (If the A were placed at the head of column 7 in No. 1, then 

column 6 would lack a letter at the bottom.) Cases of “accidental identities” of course com- 
L plicate the process of cutting up the text into the respective columns, but they only serve to 

f[ add a small degree of interest to what would otherwise be a purely cut and dried process. 

f The final results of the transcription into columns are shown in figure 27 b. 
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e. It is obvious from a comparison of these two skeletonized matrices, and a consideration 
of the fact that the long columns must of necessity go to the left side, that the numbers 7 and 10 
occupy the first two positions in the key, and that the numbers 2, 4, 11, and 13 occupy the last 
four positions in the key. By segregating and anagramming columns 7 and 10 as one group, 
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\ | and col umns 2, 4, 11, and 13' as another group, the exact positions occupied by these 6 columns 

f ! are easily ascertained, as shown in figure 27c. 
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/. The remaining columns 1, 3, 5, 6, 8, 9, 10, 12, and 14 form a third group of columns to be 
anagrammed, but this is rather easy now that the columns on either side are fixed. The com- 
pleted rectangles arc shown in figure 27 d. 
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24. Messages with similar endings, — a. What has been said at the beginning at the pre- 
ceding paragraph with respect to the nature of military correspondence and the presence of 
identical phraseology in the messages sent by a superior commander to his subordinates also 
operates to produce messages in which the endings are identical. It has been noted that when 
two messages with similar beginnings are available for comparison, the reconstruction of the 
transposition rectangles and the recovery of the transposition key is an easy matter. It will 
now be shown that solution is an even easier matter when two messages having identical endings 
are available for study. 

b. Given the following two cryptograms: 



E T R T E 
E E T R 0 
S R B E N 

T L V S X 
I V Y M R 
C I A A I 



E E S 0 A 
U D C C C 
I G S K A 

0 P N R E 
V E S I R 
N S C W N 



A E U N I 

0 H T C Y 

1 L N R A 

M E F D S 
E E N E I 
A 



No. 1 

V A F L N 
M R R E A 
N F N A D 
No. 2 

K Y E N R 
N 0 L T M 



I A M N D 
R H I T N 
A L 0 L T 

U E E R B 
N N E D E 



R Y H R V 
D E Y E N 
X 0 M A H 

T S R E H 
TROOP 



M E N R I 
R N E R V 
H R R E I 

T I A N T 
U N A R A 
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The cryptanalyst now carefully compares the two texts, searching for identical sequences of 
letters, but in this case instead of trying to locate identities in what may be termed a parallel 
progression (as in the preceding case) he searches for identical sequences of two or more letters 
appearing in both messages. For example, in the present case, he notes the sequence T R 0 
forming the final trigraph of the 8th group of No. 1 and finds a similar sequence forming the 
initial trigraph of the 13th group of No. 2. Going through both cryptograms in this way, all the 
identities are marked off in some fashion, by colored crayon or underlining, as shown below. In 
this search for identities the cryptanalyst bears in mind that when all have been found they 
should be distributed at quite regular intervals throughout the text. For example, note in the 
following that the identities in No. 1 fall at intervals of 6 letters, with one exception; in No. 2 
they fall at intervals of 4 letters, with one exception. The intervals between identities serve as a 
guide in finding them. After they have all been located, the identities in the cryptograms are 
numbered serially. 
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c. The identities between the two cryptograms may now be equated, using for this purpose 
the numbers below the identities. For instance, identity 1 in cryptogram 1 matches identity 7 
in cryptogram 2; identity 2 in crytogram 1 matches identity 6 in cryptogram 2, and so on. Thus: 



Cryptogram 1 - 1234 56 789 10 11 12 13 

Cryptogram 2. 7692 10 51134 12 13 1 8 



d. Now cryptogram 1 has 105 letters; since the key consists of 13 numbers (indicated by the 
13 identities), the rectangle for cryptogram 1 contains 12 columns of 8 letters and 1 column of 9 
letters. Cryptogram 2 has 81 letters, and its rectangle contains 10 columns of 6 letters and 3 
columns of 7 letters. The rectangle of cryptogram 1 has but 1 long column, whereas that of 
cryptogram 2 has 3 long columns. Relative to the position the last letter in each rectangle occu- 
pies in the last row of the rectangle, it is obvious that the last letter of the rectangle for crypto- 
gram 2 is 2 letters in advance of the last letter of the rectangle for cryptogram 1. Using this 
difference , viz, 2, a cyclic sequence is generated from the series of equivalencies given above. 
Thus, the equivalent of identity 1 of cryptogram 1 is identity 7 of cryptogram 2, and the number 
7 is placed two intervals to the right of the number 1; the equivalent of identity 7 of cryptogram 
1 is identity 11 of cryptogram 2, and the number 11 is placed two intervals to the right of number 
7, and so on until the following sequence is obtained: 

1 2 3 4 5 6 7 8 9 10 11 12 13 

1 7 11 13 8 3 9 




e. The equivalent of identity 9 of cryptogram 1 is identity 4 of cryptogram 2, and the num- 
ber 4 is placed between the numbers 1 and 7 in this sequence, for the sequence may be regarded 
as partaking of the nature of a cycle or a continuous series. From this point on, the process is 
the same as before, and finally the following is obtained: 

1 2 3 4 5 6 7 8 9 10 11 12 13 

1 4 7 2 11 6 13 5 8 10 3 12 9 

/. After little experiment it becomes obvious that column 8 belongs on the extreme left 

because in cryptogram 1 there is only one long column, number 8, ascertained by counting the 

number of letters between successive identities in that message. The number 8 being at the 
extreme left the final actual transposition key is 8 10 3 12 9 1 4 7 2 11 6 13 5. The completely 
deciphered messages are shown in figure 28. 



No. 1 



8 10 3 )2 9 1 4 7 2 11 6 13 5 



No. 2 



8 10 3 12 9 1 4 7 2 11 6 13 



HEADREDCOLUMN INFANTRYPOINT 

INFANTRYANDAR REDCOLUMNPASS 

TILLERYMARCHI EDSILVERRUNCR 

NGNORTHREACHE EEKATSEVENTWE 

DSILVERRUNCRE NTYAMXREMAINH 

EKATSEVENFORT EREINOBSERVAT 

YAMXREMAINHER ION 

EIN0BSERVATI0 



g. The possibility of the rapid solution of columnar transposition ciphers by means of the 
method of similar beginnings and endings, constitutes one of the most serious drawbacks to the 
use of transposition ciphers in military cryptography, because it is almost impossible to avoid 
such cases where many messages must be sent in the same key each day. 

25. Solution of a single message containing a long repetition. — a. Sometimes a lengthy phrase 
or a series of numbers (spelled out in letters) is repeated within a message and if the message is 
enciphered by a transposition rectangle of such narrow width (in comparison with the length of 
the repetition) that the repeated portion forms identical sequences within the text of the crypto- 
gram, a solution somewhat similar in principle to that explained in paragraph 24 may be achieved 
within a few minutes. 

b. Note the following cryptogram, in which identical portions have been underlined. 

Cryptogram (169 letters) 

0EAEL TRS E_D H_N U F F R N R YF NTAED IL S M Y 

la 16 2a 

N C E T S L S TOC AWIA0 T S L S S L E D H N ORIIS 

26 3a 3b 

F E B N N UUP WES SMY E RCNN0 RVT TAP GNUG 

4a 46 5a 

GTI FE RSE0M SWE R N R AST BOS AAA 0SN00 

56 6a 66 

I BOS D C A Y H L H0NEM SETF Y H L A U X TAP G G 

7 a 76 8a 86 

RRSVL YEE G G T I S S 0 UUP V 

9a 96 
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c. There are 18 segments of underlined letters, which means in this case that the rectangle is 
9 columns wide, because the repeated portion in the text will give rise to two repeated sequences 
in each column. This means that the rectangle has 7 columns of 19 letters and 2 columns of 18 
letters. The first two segments may therefore be assigned the number's la and 16, since they 
come from column 1 ; the next two segments may be assigned the numbers 2 a and 26, since they 
come from column 2, and so on, as shown above. Identical segments may now be equated. 
Thus: 

la 2 a 3a 4 a 5a 6a 7a 8a 9a 

36 46 26 96 86 16 66 76 56 

This gives rise to the cycle 1—3— 2-4— 9-5— 8— 7— 6, which is a cyclic permutation of the actual 
transposition key. 

d. By transcribing the text into a rectangle of proper width, “cutting” the columns so as to 
bring the identical portions within the same rows, the result shown in figure 29 is obtained. 
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Figure 29. Figure 30. 



e. Study of figure 29 shows that columns 2 and 7 are the short columns and belong on the 
right, either in the sequence 2-7 or 7-2. The cyclic permutation of the transposition key obtained 
in subparagraph c is 1-3-2-4-9-5-8-7-6. In order to bring the 2 and 7 adjacent in a sequence 
2-7 or 7-2 one must take intervals of 5 and 4, respectively, and “decimate” the cycle, giving the 
following: 1-5-3-8-2-7-4-6-9 or 1-9-6-4-7-2-8-3-5. Since columns 2 and 7 belong on 
the right, the key must be: 4-6-9-1-5-3-8-2-7 or 8-3-5-1-9-6-4-7-2. Only a few moments are 
necessary to establish the correctness of the former alternative and the solution is at hand. It is 
as shown in figure 30. 

f- A g°°d understanding of the principles elucidated in this and the preceding paragraph 
will enable the student to derive for himself the procedure applicable to cases of somewhat 
similar nature, such as that wherein a single letter or a whole group has been omitted from the 



51 




first version of a message and a second (correction message) is sent without paraphrasing the 
original text; or that wherein two messages are alike except for a difference in a single word (such 
as a number) and are cryptographed by identical transposition keys, or that wherein the numeri- 
cal key has been incorrectly derived from the literal key and two versions of the same plain text are 
available for comparison, one based on a transposition by means of the incorrect key, the second 
based on a transposition by means of the correct key, both keys, however, being of the same 
length. 

26. Solution when several cryptograms of identical length and in the same key are avail- 
able. — a. Although the method to be described in this paragraph is included within the category 
of special solutions, it is of such general applicability that it might well be treated as a general 
solution for all transposition systems. It is based upon the very mechanics of transposition as a 
cryptographic scheme, viz, that the essential feature of the transposition method consists merely 
in the alterations in the positions of the elements (letters, groups of letters, or words) composing 
the plain text, according to a specific key. It follows, therefore, that the respective elements of 
two or more messages of identical lengths, when transposed according to the same key, will undergo 
identical alterations in position in the course of encipherment, and therefore all plain-text ele- 
ments occupying homologous positions in the original messages will emerge in homologous posi- 
tions in the cryptograms. The situation is very much like that which may be observed in the 
movements executed by two symmetrical groups of dancers in a chorus. Suppose each group 
consists of 8 dancers starting originally in definite positions relative to one another. When a 
movement is executed each dancer in each group performs certain evolutions ; at the conclusion 
of the movement the 8 dancers in each group may be in quite different positions relative to one 
another than they were at the beginning of the movement, but the correspondingly numbered 
dancers in both groups find themselves in identical positions relative to their neighbors. Of 
course, the fact that in this analogy the groups are based upon 8’s is of no significance; if the 
groups consisted of many more the principle would still apply. Another way of looking at the 
matter is to call attention to the fact that in any type of transposition the position which a specified 
letter or element of the plain text will occupy in the final cryptogram is quite definitely a function of the 
number of letters or elements in the plain text itself. For example, suppose that a plain-text message 
contains exactly 100 letters, and suppose that the transposition system and specific key is such 
that the 1st plain-text letter appears as the 17th cipher-text letter, the 2d plain-text letter, as the 
68th, and so on; in another message of exactly 100 letters, enciphered by the same general system 
and specific key, it is obvious that the 1st plain-text letter must also appear as the 17th cipher- 
text letter, the 2d plain-text letter, as the 68th, and so on. In short, all correspondingly num- 
bered plain-text letters in both messages will appear in identical positions in the cryptograms. 

6. Granting the obvious truth of the foregoing, to what use can it be put in the solution of 
transposition ciphers? Simply this: It enables the cryptanalyst to reconstruct the plain texts of 
cryptograms of identical length without even knowing what the transposition key or system was that 
produced them. The process is not at all complicated and if there are several messages the 
process is very easy. It consists in superimposing the several cryptograms and anagramming 
the columns formed by the superimposition, for it is obvious that any circumstances which can 
be used as a guide for rearranging the letters in one of the lines of superimposed text in order 
to form plain text will require, and can be checked by, the results of an identical rearrangement 
of the corresponding letters of the other lines of superimposed text. 

c. An example of the method involving the application of this general solution will now 
be given, using as a basis five messages assumed to have been enciphered by an unknown but 
complex type of transposition. It will now be shown how the security of such a system is demol- 
ished when it is used by a large number of intercommunicating commands. 
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d. Let the following be five cryptograms isolated from among many messages intercepted 
on the same day and therefore suspected of being in the same key. These five cryptograms 
have been isolated because they all contain exactly the same number of letters. They are here 
shown superimposed (fig. 31) and therefore all the letters in one column have undergone exactly 
the same evolutions or changes in position in the course of encipherment. 

Column No 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 

Message No. i 1 A A L N E 0 F S G T 0 G V E R A N 0 L N D U 0 D E I H I S A T 

Message No. D N M R G R E 0 N A R I E U E T N Y I T C 0 F E A I E P T T A 

Message No. 3 A NELNEXEHGILACEMEENLFXTEEEISIGAO 

Message No. 4 .E E N E T S L N N F T C 0 I D 0 S E A I L F I G D W I A A R N 0 

Message No. 5 R A M E T M I 0 N 0 D I U M A L L I N X 0 A T G T N N A I B T N 

Column No 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 

Message No. i F TDNRLV0R0DSWEER0RQ 

Message No. 2 R DTEDNSOEIPECMFEARN 

Message No. 3 R WLLDLVV0RDEL0CH0TH 

Message No. 4 1 HNLLNRFVWLREMRAIEA 

Message No. ITNIASDRMSECUIOVSA 

Figure 31. 

e. Noting a Q in message 1 column 51, the obligatory sequence Q U is assumed to be present 
in that message. There is in message 1 but one U, which is fortunate. Combining columns 51 
and 23, the results are found to be fair (fig. 32a). The H T in the third row suggests a word 
ending in G H T, such as FIGHT, MIGHT, EIGHT, etc. Searching in message 3 for a G, two candi- 
dates are found: columns 10 and 30. The trigraphs yielded by each combination are shown in 
figure 326, The second of the two possibilities looks much the better. The trigraph in the 
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10 51 23 


30 51 23 
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N 0 


N N 0 


T N 0 
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T N 0 T C 
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RAIN 


R A I N F 
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OAT 


BAT 


B A T T 


B A T T A 


Figure 32a. 


Figure 326. 




Figure 33a. 


Figure 336. 



first row suggests the word SQUARE or SQUADRON; that in the last row suggests BATTLE or 
ATTALI0N. This means that a column with an A at the top and a T at the bottom should be 
sought. There is only one such column, 31. Adding it to the 30-51-23 combination gives 
what is shown in figure 33a. Looking for a column with a D at the top (for SQUAD) and either an 
A (for BATTALION) or an L (for BATTLE), there is only one candidate, column 22, yielding the 
sequences shown in figure 336. Enough has been shown of the procedure to make further demon- 
stration unnecessary. Once a good start has been made, progress is quite rapid, unless the 
cryptanalyst is unfortunate and arrives at a point where all the messages simultaneously ter- 
minate in complete words, without a clue as to what follows or precedes in any one of the mes- 
sages. In such a contingency the only thing he can do is to try all sorts of possible continuations, 
either “fore” or “aft,” that is, in front of the original starting point or after it, until he picks up 
another word which will enable him to continue. Or he may have to search for a new point of 
entry and build upon that, later joining this structure with the other. In the case under ex- 
amination no serious difficulties are found and the entire set of five messages is reconstructed. 

/. In the course of this reconstruction the numbers applicable to the columns become assem- 
bled in proper sequence, that is, ip the correct order to reproduce the plain text, This sequence, 
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constituting the C— >P sequence, is shown in figure 34 as the second row of numbers. 



Term number 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 



C-4P sequence. 
Message No. 1. 
Message No. 2. 
Message No. 3. 
Message No. 4. 
Message No. 5. 



28 3 14 46 19 37 25 47 48 26 35 41 2 34 27 12 36 45 17 13 40 18 9 24 33 8 1 50 44 11 



HAVE0RDERE 

ENEMYDEFEA 

SEC0NDECHE 

ANIMALDRAW 

AMMUNITION 



DRATI0NWAG0 

TEDDIRECTI0 

L0NWILLLEAV 

NVEHICLES0F 

TRAININCLUD 



NSOFFIRST 

N0FRETREA 

EHEREATEI 

ENGINEERT 

INGH0RSED 



Term number 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 

C->P sequence 30 51 23 31 22 16 7 21 32 42 10 49 4 43 15 5 39 29 20 38 6 

Message No. i SQUADR0NT0G0LDENVILLE 

Message No. 2 TNOTCERTAINAMPURSUING 

Message No. 3 GHTAXMXF0RG0LDENVILLE 

Message No. 4____ RAINF0LL0WFIELDTRAINS 

Message No. 5 B A T T A L I 0 N M 0 V E S A T S I X A M 

PlQUEE 34. 



g. The solution by superimposing and anagramming equal-length messages in the case of 
transposition constitutes a general solution which is applicable in all cases without exception. 
Indeed, the possibility of solution by this method constitutes the most serious, if not fatal, weak- 
ness of transposition as a cryptographic method, for not only is it applicable to the most complex 
as well as to the most simple types of transposition, but, what is much more serious, the pro- 
cedure is very simple, requiring very little cryptanalytic ingenuity or exnertness. The chief 
disadvantage of this general solution is, of course, that it is dependent upon the more or less 
fortuitous availability of messages of identical lengths, and while this fortunate contingency is 
quite frequent in a voluminous correspondence, it would naturally be better from the point of 
view of the cryptanalyst if this requirement were not essential in all cases. Deeper study of 
the subject will show that the method can still be applied in a modified way to the case of mes- 
sages of almost the same lengths when the transposition is not too involved. To illustrate, 
a case of simple keyed-columnar transposition will be used and it will be assumed that several 
messages of approximately identical lengths are at hand. 

h. First, take the case of two messages which have been enciphered by completely-filled 
rectangles, one message having, for example, one more row of letters than the other. In the 
discussion, the consecutive numbers 1, 2, 3, . . . will be employed as though they constituted 
the successive letters of a plain-text message that is being enciphered. This method of treat- 
ment is very useful in connection with studies of the mechanics of transposition ciphers in 
general, and especially so in the case of double transposition. Note the P— »C sequences that 
result from the transposition: 



6 2 5 7 4 1 3 



6 2 5 7 4 1 3 



01 02 03 04 05 06 
08 09 10 11 12 13 
15 16 17 18 19 20 
22 23 24 25 26 27 
A 



07 


01 


14 


08 


21 


15 


28 





02 03 04 05 06 07 
09 10 11 12 13 14 
16 17 18 19 20 21 
B 



P-»C sequence for A 06 13 20 27 02 

08 15 22 04 11 
P-»C sequence for B 06 13 20 02 09 



09 16 23 
18 25 


07 


14 


21 


28 


05 


12 


19 


26 


03 


10 


17 


24 


01 


16 07 14 

Figure 35a 


21 


05 


12 


19 


03 


10 


17 


01 


08 


15 


04 


11 


18 
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It is obvious that the two sequences may be superimposed so as to bring identical sections into 
superimposition. Thus: 

A 06 13 20 27 02 09 16 23 07 14 21 28 05 12 19 26 03 10 17 24 01 08 15 22 04 11 18 25 

B 06 13 20 □ 02 09 16 □ 07 14 21 □ 05 12 19 □ 03 10 17 □ 01 08 15 □ 04 11 18 □ 

The 7 blank spaces in the B line mark the ends of the columns in the transposition rectangle. 
The regularity in the distribution of the blank spaces follows from the mechanics of encipherment. 
If two messages were superimposed in this manner it is clear that a solution by anagramming 
becomes perfectly feasible. Moreover, anagramming of columns is perhaps unnecessary, for 
anagramming merely the letters that would occupy in line A the positions marked by the blanks 
in line B will yield the transposition key dhectly. Extension of these principles to the case in 
which the two rectangles differ by 2, 3, 4, . . . complete rows is obvious. 

i. Taking next a case wherein two rectangles differ by one or two letters in the bottom row, 
it is clear that by shifting the letters of one message one or two spaces to the right (or left) from 
a given point will bring most of the text into proper superimposition for a solution by anagram- 
ming. Note the P— »C sequences applicable to the following transpositions: 

6 2 5 7 4 1 3 6 2 5 7 4 1 3 

01 02 03 04 05 06 07 01 02 03 04 05 06 07 

08 09 10 11 12 13 14 08 09 10 11 12 13 14 

15 16 17 18 19 20 21 15 16 17 18 19 20 21 

22 23 24 25 26 27 22 23 24 25 

A B 

P~>C sequence for A... 06 13 20 27 02 09 16 23 07 14 21 05 12 19 26 03 10 17 24 01 08 

15 22 04 11 18 25 

P-*C sequence for B... 06 13 20 02 09 16 23 07 14 21 05 12 19 03 10 17 24 01 08 15 22 

04 11 18 25 

Figure 35* 

It is possible to superimpose these two sequences by shifting the sections in line B after certain 
numbers. Thus: 

A— 06 13 20 27 02 09 16 23 07 14 21 05 12 19 26 03 10 17 24 01 08 15 22 04 11 18 25 
B___06 13 20 □ 02 09 16 23 07 14 21 05 12 19 □ 03 10 17 24 01 08 15 22 04 11 18 25 

In the case of actual messages corresponding to the foregoing P— »C sequences, superimposition 
of the two texts in the manner indicated would at once permit of a solution by anagramming of 
columns. The unknown factor, of course, is the location of the blank spaces. Where the two 
messages differ in length by only one or two letters brief experimentation would tell the story; 
where the messages differ in length by a good many letters the process would be much more 
difficult but not at all hopeless of fruitful results. Only a small section of text reconstructed by 
anagramming will soon lead to complete solution. Hence, it follows that by regulating the num- 
ber of blanks to be left here and there and judicious shifting of sections of text, solution by super- 
imposing and anagramming homologous sections of text from several messages in the same trans- 
position key will often be possible. 
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j. The foregoing principles will naturally not be applicable to cases where two messages differ 
in length by but one letter and this small difference brings about a profound difference in the P-»C 
sequences applicable to the messages. This is what happens often in the case of true double 
transposition, 1 but the principle can nevertheless be applied even here. An explanation of the 
procedure lies beyond the scope of the present text, however, and no more will be indicated herein 
concerning the matter in the case of true double transposition. However, in certain cases of 
combined substitution-transposition to be discussed in a later portion of this text the principles 
elucidated in these last few subparagraphs may be found to be applicable. 

27. Reconstruction of the keys in double transposition. — a. Having reconstructed the plain 
texts of the messages solved by superimposing and anagramming, as explained in paragraph 
26 d, e, can the transposition key be found? First, it is necessary to ascertain whether a single 
columnar transposition had been used and, if not, then the assumption will be that a double 
transposition had been used. 

b. If a single transposition were the case, the relationship pointed out in paragraph 16c, con- 
cerning the existence of a constant difference between successive elements of the P— >C sequence, 
should obtain. Having the C— >P sequence, the P— >C sequence may readily be established by 
inversion of the former. Hence, the P— *C sequence is constructed by inversion, as shown in 
figure 36a. 
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Figure 36a 



c. (1) Since there appears to be no constant difference between successive terms in the 
P — » C sequence in figure 36a, single columnar transposition is ruled out and double transposition 
is assumed to have been employed. In passing, it is worthwhile noting that the reconstruction 
of the keys employed in the case of true double transposition is quite important, because it is 
often the case that concentrated effort directed toward the cryptanalysis of one or more messages 
and the subsequent recovery of the transposition keys will, of course, greatly facilitate the 
reading of all other messages in the same keys. 

(2) There are at least four methods suited to the purpose and they will be dealt with in an 
order most conducive to their comprehension by the student. 

(3) A preliminary to the reconstruction of the keys in the case of each of the four methods 

L to be studied consists in establishing or ascertaining the width of either the T-l or the T-2 
matrix, usually the former, because it is easier to do. 

1 See Special Text No. 166, Advanced Military Cryptography, sec. IV. 
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(4) As in paragraph 26 h, the exposition will employ matrices in which the consecutive 
numbers 1, 2, 3, . . . take the place of the successive plain-text letters in the T— 1 matrix, 
because in such handling significant facts arising from the mechanics of encipherment are brought 
to light. 

d. In order to study the effects of true double transposition on this matter of reconstructing 
the keys an example will be employed, involving transposition with two different keys. Let 
the “message” and the keys be as shown in figure 37a: 
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Figuke 37a. 



Nothing in the nature of a series of constant differences between successive terms is now discernible 
in the P — » C sequence. But there is, as can readily be seen, a fairly constant relationship 
between segments or sections of this sequence. For example, take the 1st to 6th terms of this 
P — > C sequence (20 06 48 33 15), set them under the 29th to 34th terms (28 14 05 41 

23), and find the difference between superimposed numbers. (When the minuend is less than 
the subtrahend the superimposed terms are disregarded.) Thus: 

29th to 34th terms 28 14 05 41 23 

1st to 6th terms.. 20 06 48 33 15 

Differences.... 8 8 8 8 
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There is a constant difference between the superimposed terms. The reason for its appearance 
is not hard to understand if reference is made to figure 37a and the matter is studied in the light 
of the mechanics of the method of encipherment. As for the two terms 28 and the 20, while 
they come from different columns in the T-2 matrix, both come from the same column of the 
T-l matrix, as do 14 and 06, 41 and 33, 23 and 15. But the 05 and the 48 not only come from 
different columns in the T-2 matrix, but also from different columns in the T-l matrix, this 
representing a case where there is a transit from the bottom of one column to the top of the next 
column in the transposition process. Now the constant difference is in this case 8 because 
the superimposed terms happen to be sequent in the columns in which they fall in the T-l matrix. 
If the superimposed terms are in the same column in the T-l matrix but separated by one row, 
the constant difference will be 16; if separated by two rows, the constant difference will be 24, 
and so on. Thus, for example: 

6th to 11th terms 44 30 21 03 39 

29th to 34th terms 28 14 05 41 23 

16 16 16 16 

Here the difference, 16, is a multiple of 8 because the superimposed terms are separated by one 
row in the T-l matrix, as can be seen by referring to figure 37 a. 

e. The foregoing phenomena afford a method of ascertaining the width of the T-l matrix 
in an unknown case, and, as noted above, this constitutes the first step in recovering the transposi- 
tion key or keys. For if a study be made of the terms of the P -> C sequence in figure 36a, 
based upon finding sections thereof which show a constant difference, the latter will correspond 
to either the width of the T-l matrix or a multiple of the width. An easy way to make this 
study is to take a section of the P -* C sequence in figure 36a, add 5, 6, 7, . . . (in successive 
steps) to each term of the selected section, and then look for repetitions between the original 
P -> C sequence and the P — > C sequence plus the additive. A beginning will be made with an 
assumption of a T-l matrix of 5 columns. Since the cryptograms contain only 51 letters, all 
totals greater than 51 will be disregarded. Hence it is best to take a section which has a long 
series of low numbers, so that when the additive is applied the majority of the totals will not 
exceed 51. Such a series is the following (only one term in it, the 29th, is close to the maximum) : 

Term number 21 22 23 24 28 28 27 28 29 30 31 32 33 34 35 38 37 

P C sequence 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06 

P ^>C sequence +5.. . 43 40 38 29 12 15 20 06 36 39 44 30 19 16 22 11 

Searching for repetitions between the P— »C sequence and the P— »C sequence +5, the results are 
negative. Trial is then made of additives 6 to 1 1, inclusive, with similar negative results. When 
an additive of 12 is applied, however, the results obtained give positive indication that the T-l 
matrix is 12 columns in width. Thus: 

Term number.. 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 

P-*C sequence 38 35 33 24 07 10 15 01 48 31 34 39 25 14 11 17 06 

P^C sequence +12..... 50 47 45 36 19 22 27 13- 43 46 51 37 26 23 29 18 



It will be seen, on referring to figure 36a, that the following repetitions (with the term numbers in 
each of the sequences indicated) are present: 



Term no. in P-»C sequence. 
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The width of the T-l matrix is therefore 12 and its outlines may at once be drawn, since the total 
number of letters in each message, 51, indicates that there are 3 long columns of 5 letters and 9 
short columns of 4 letters. 
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j. (1) There is another method of ascertaining the width of the T-l matrix, which is perhaps 
a bit shorter and more direct than that described above. Basically both methods are the same, 
the one now to be presented being but another way of looking at the matter. Suppose that the 
differences between successive terms in the P— >C sequence of figure 37a are calculated and set 
down as shown below, and then repetitions are sought in the series of differences, the latter 
constituting what will hereinafter be termed the P— >C interval sequence. Thus: 

Term number... oi 20 03 04 05 09 07 os 09 10 11 12 13 14 i6 

P-^C sequence .. 20 06 48 33 15 44 30 21 03 39 04 42 32 17 51 

P— >C interval sequence ... —14+42 — 15 — 18 + 29 — 14 —9 — 18 + 36 — 35 + 38 — 10 — 15 + 34 — 15 
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Figure 37 b 



Several repetitions are noted and underscored, in the same manner that ordinary repetitions are 
indicated in analogous cryptanalytic procedure. Now take the longest repetition, —14—9+36 
— 18, and find the terms from which it originates in the P— >C sequence; a constant difference of 
8 will be found. Thus: 

(Term numbers 16-20) 36 22 13 49 31 

(Term numbers 29-33) 28 14 05 41 23 

Differences. 8 8 8 8 8 

The other repetitions will show the same constant difference. The terms which produce the 
repetitions will be found to be located in the same columns of the T-2 matrix in figure 37a, and 
reference to that figure will show that the constant difference between the sets of terms producing 
repetitions in the P— »C interval sequence is merely the result of the mechanics of encipherment. 

(2) In similar manner, if the interval sequence is constructed for the P— >C sequence of 
figure 36a, the repetitions underscored in figure 366 are noted: 



Term number 


01 02 


03 04 


05 


06 07 


08 


09 


10 


11 


12 


13 


14 


15 


P— >C sequence 


27 13 


02 43 


46 


51 37 


26 


23 


41 


30 


16 


20 


03 


45 


P— >C interval sequence... 


- 14-11 


+ 41 +3 


+ 5 


- 14-11 


- 


-3 + 18 


— 


11-14 


+ 4 - 


17+42 -9 


Term number 


16 17 


18 19 


20 


21 22 


23 


24 














P-»C sequence 


36 19 


22 05 


49 


38 35 


33 


24 














P— >C interval sequence 


-17 +3 


-17 + 44 


-11 


-3 -2 


- 


- 9-17 














Term number 


25 26 


27 28 


29 


30 31 


32 


33 


34 


35 


36 


37 


38 


39 


P — >C sequence 


07 10 


15 01 


48 


31 34 


39 


25 


14 


li 


17 


06 


50 


47 


P— >C interval sequence 


+ 3 +5 


-14 + 47 


-17 


+ 3 +5 


— : 


14-11 


- 


-3 +8 


— 


11+44 - 


3-26 


Term number 


40 41 


42 43 


44 


45 46 


47 


48 


49 


50 


51 








P— >C sequence 


21 12 


40 44 


29 


18 04 


08 


09 


42 


28 


32 








P — interval sequence 


-9 + 28 


+ 4-15 


-11 


-14 +4 


+ 1+33 


— 


16 +4 











Figure 366 
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Taking the sections of the P->C sequence from which the longest repetition arises and finding 
the constant difference between the terms involved, a width of 12 for the T-l matrix is indicated. 
Thus: 

(Term numbers 04-09) 43 46 51 37 26 23 

(Term numbers 30-35) 31 34 39 25 14 11 



Differences. 



12 12 12 12 12 12 



This is identical with the results found by the other method. The T-l matrix for the messages 
of paragraph 26 d is therefore 12 columns in width. 

g. Having ascertained the width of the T-l matrix, the next step is to ascertain whether 
the width of the T-2 matrix is the same as that for the T-l, or different. If the same, the sus- 
picion is warranted that the transposition keys for both matrices may be identical, in which case 
it is necessary to recover but one key. If the widths of the two matrices are different, then 
it is obvious that two different transposition keys are involved. Having ascertained the widths 
of both matrices, one can proceed to reconstruct the transposition key or keys which apply 
thereto. There are, as stated once before, at least four methods suitable for this purpose. They 
will now be taken up in turn, and each method will be explained in detail. 

h. (1) In explaining the first method the discussion will be initiated with a reconsideration 
of figure 37 a. If the C->P sequence established in that figure is treated as though it were plain 
text and enciphered by the double transposition method, using the same two transposition keys 
as before, an interesting phenomenon is observed. Not the following (fig. 37c): 



6 2 7 1 5 3 8 4 

27 47 09 11 31 02 42 44 
23 34 50 38 18 30 05 26 
14 43 37 01 08 17 33 22 
41 25 46 29 49 07 20 13 
04 21 28 16 36 48 10 40 
32 12 24 06 45 35 51 03 
19 39 15 1 



T-l 



391 742 11 8 10 66 

11 38 01 29 16 06 47 34 43 25 21 

12 39 02 30 17 07 48 35 44 26 22 

13 40 03 31 18 08 49 36 45 27 23 

14 41 04 32 19 09 50 37 46 28 24 

15 42 05 33 20 10 51 j 



T-2 

Figure 37c. 



Here it is seen that the numbers in the columns of the T-2 matrix are consecutive. Obviously, if 
the columns of this T-2 matrix were retranscribed in a matrix of the same outlines as the T-l 
matrix, the numbers would be consecutive in row's and would represent the plain-text sequence 
1, 2, 3, . . . , inscribed within a T-l matrix in the normal fashion. Thus (fig. 37 d): 



6 


2 


7 


i 


6 


3 


8 


4 


01 


02 


03 


04 


05 


06 


07 


08 


09 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


20 


21 


22 


23 


24 


25 


26 


27 


28 


29 


30 


31 


32 


33 


34 


35 


36 


37 


38 


39 


40 


41 


42 


43 


44 


45 


46 


47 


48 




ou 


ill 


I - 











•4 




! 



Figure 37 d. 
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The result of these three steps has been to effect a return to the original T-l matrix containing 
plain text in normal sequence. The principal point to be noted here is the appearance of the 
T-2 matrix in figure 37c, for it is the basis of the first method for recovering the transposition 
keys, as well as for other operations in connection with double transposition. 

(2) To demonstrate the procedure, the data afforded by figure 37a again will be employed. 
Let the C— »P sequence be inscribed within a matrix of 8 columns (the width having been estab- 
lished by one of the methods set forth in subpars. d-j). Thus: 



1 


2 


3 


4 


5 


6 


7 


8 


27 


47 


09 


li 


31 


02 


42 


44 


23 


34 


50 


38 


18 


30 


05 


26 


14 


43 


37 


01 


08 


17 


33 


22 


41 


25 


46 


29 


49 


07 


20 


13 


04 


21 


28 


16 


36 


48 


10 


40 


32 

19 


12 

39 


24 

JU 


06 


45 


35 


51 


03 


_ 
















Figure 37c 









Find the column in which term 01 appears and set that column down horizontally; placing a 
vertical bar before and after the series of numbers to set them off as belonging to one column. 



Step (1) 



11 38 01 29 16 

Figure 37/ (1). 



06 



Then find the column in which the term 02 appears and set it down under the row of numbers 
given in Step (1). Thus: 

| 11 38’ 01 29 16 06 | 

I 02 30 17 07 48 35 I 



Step (2) 



Figure 37/ (2). 



Note the ascending superimposed numbers 01, 02; 29, 30; 16, 17; 06, 07. Continue to build up 
on this structure in the manner depicted in successive steps as follows: 



11 38 01 29 16 06 



1 Step (3) 












| 02 


30 


17 


07 


48 


35 


!■■ ] 


| 44 


26 


22 


13 


40 


03 


1 










r ; 








111 


38 


01 


29 


16 


06 


1 




| Step (4) 












| 02 


30 


17 


07 


48 


35 




| 44 


26 


22 


13 


40 


03 


1 










j ‘y 




| 27 


23 


14 


41 


04 


32 


19 








r 








1 11 


38 


01 


29 


16 


06 


^ 48 




6 . 












| 02 


30 


17 


07 




35 


1 5 Step (5) 


| 44 


26 


22 


13 


40 


03 


1 














| 27 


23 


14 


41 


04 


32 


19 


1 






it ' : 










I 42 


05 


33 


20 


10 


51 


1 



Figure 37/(3) (4) (5). 



The numbers 01 to 05, inclusive, here have formed the basis for building up the structure shown 
as Step (5). The next term in the sequence is 06 but it is already in the structure, as is also 07. 
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In the column in which 06 and 07 appear there is just room enough for 08 and 09, since the term 
10 is already shown at the bottom of the column. Hence: 



Step (6) 



Step (7) 



|11 38 01 29 16 06 | 

| 02 30 17 07 48 35 | 

1 44 26 22 13 40 03 131 18 08 49 36 45 1 
| 27 23 14 41 04 32 19] 

1 42 05 33 20 10 51 1 

|11 38 01 29 16 06] 

| 02 30 17 07 48 35 | 

1 44 26 22 13 40 03 [ 31 18 08 49 36 45 J 

1 27 23 14 41 04 32 19109 50 37 46 28 24 15 1 
|42 05 33 20 10 511 



|11 38 01 29 16 06 | 

| 47 34 43 25 21 12 39 | 02 30 17 07 48 35 | 

Step (8) 1 44 26 22 13 40 03 J 31 18 08 49 36 45 1 

| 27 23 14 41 04 32 19 | 09 50 37 46 28 24 15 | 

] 42 05 33 20 10 51 | 

Figure 37/(6) (7) (8). 

The process is continued in this manner until, as shown in figure 37/(9), all the numbers of the 
C-*P sequence have been placed. (Here the last number is 51.) 



Step (9) 



1 47 34 43 25 21 

1 44 26 22 13 40 03 1 31 
1 27 23 



11 38 01 29 16 06 | 47 34 43 25 21 12 39 | 

12 39 | 02 30 17 07 48 35 | 44 26 22 13 40 03 | 

18 08 49 36 45 | 27 23 14 41 04 32 19 | 

14 41 04 32 19 | 09 50 37 46 28 24 15 | 



1 09 50 37 46 28 24 15 1 42 05 33 20 10 51 

Fiqurk 37/ (9). 



The T-2 matrix may now be drawn within the confines of the structure shown in this last figure. 
The positions of vertical lines to be placed at the left and right to mark the exact outlines of the 
matrix may now readily be found by referring to the matrix in figure 37c. It is obvious that the 
column with the terms 11-15 belongs at the extreme left of the T-2 matrix, the column with the 
terms 21-24 belongs at the extreme right. The transposition key for the matrix may then be 
established directly from the matrix itself, by following the sequence of numbers in the columns. 
Thus: 



| 47 34 43 25 21 
| 44 26 22 
1 27 23 

1 09 50 37 46 28 24 



11 38 01 29 16 06 | 47 34 43 25 21 

12 39 | 02 30 17 07 48 35 | 44 26 22 

13 40 03 1 31 18 08 49 36 45 1 27 23 

14 41 04 32 19 | 09 50 37 46 28 24 

15 | 42 05 33 20 10 51 



J 



12 39 1 

13 40 03 | 

14 41 04 32 

15 1 



191 



Figure 370. 
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Reference to figure 37c will show the exact correspondence between the T-2 transposition key 
and the T-2 matrix of figure 37 g with these same elements indicated in figure 37c. The trans- 
position key for the T-l matrix in figure 37e can now easily be derived from figure 37 g. It 
must be as follows: 



6 


2 


7 


I 


5 


3 


8 


4 


27 


47 


09 


11 


31 


02 


42 


44 


23 


34 


50 


38 


18 


30 


05 


26 


14 


43 


37 


01 


08 


17 


33 


22 


41 


25 


46 


29 


49 


07 


20 


13 


04 


21 


28 


16 


36 


48 


10 


40 


32 

19 


12 

39 


24 
15 l 


06 

1 


45 


35 


51 


03 



Figure 37 h. 



This transposition key and T-l matrix are identical with the key and T-l matrix of figure 37c. 

i. Note the application of the foregoing method to the C— *P sequence shown in figure 36a 
in connection with the messages solved in paragraph 26 d-e. It has already been found that the 
width of the T-l matrix is 12. The C— >P sequence of figure 36a is therefore inscribed within a 
matrix of 12 columns. 



1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


28 


03 


14 


46 


19 


37 


25 


47 


48 


26 


35 


41 


02 


34 


27 


12 


36 


45 


17 


13 


40 


18 


09 


24 


33 


08 


01 


50 


44 


11 


30 


51 


23 


31 


22 


16 


07 

20 


21 

38 


32 

06 i 


42 


10 


49 


04 


43 


15 


05 


39 


29 



Figure 3fic, 



The process explained in subparagraph h (2) above is now applied. The successive steps have 
been omitted but the final result is shown herewith: 







1 14 


27 


01 


32 


06 


| 19 36 


44 


10 


1 




48 40 


23 


15 


| 28 


02 


33 


07 


20 | 37 


45 


11 


49 


^ 42 


1 41 


24 


16 


29 


| 03 


34 


08 


21 38 | 


46 


12 


50 






| 25 


17 


30 


04 


| 35 


09 


22 39 | 


47 


13 


51 


43 




j 26 


18 


31 


05 


1 




Figure 36d. 











All the numbers from 01 to 51, inclusive, are contained within this structure. Extending it to 
the left or right to make the T-2 matrix complete, by referring to the T-l matrix, it is found 
that the structure must be made as shown herewith: 







4 


7 


1 


8 


2 


5 


9 


11 


3 


12 


10 


6 












14 


27 


01 


32 


06 


1 19 


36 


44 


10 


| 48 


40 


23 


15 


1 




40 


23 


15 


| 28 


02 


33 


07 


20 


| 37 


45 


li 


49 


1 41 


24 


16 


29 


1 


41 


24 


16 


29 


| 03 


34 


08 


21 


38 


| 46 


12 


50 


42 


| 25 


17 


30 


04 




| 25 


17 


30 


04 


| 35 


09 


22 


39 


1 47 


13 


51 


43 


j 26 


18 


31 


05 




| 26 


18 


31 


05 |' 



























Figure 36e. 
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.. 42 


32 


17 


51 


.. 34 


24 


09 


43 


.. 26 


16 


01 


35 



The transposition key for the T-l matrix is now found to be as indicated at the top of figure 36e. 

j. A second method for reconstructing the keys will now be explained. To demonstrate 
this method the data afforded by figure 37a will again be employed. Going back to the point 
where the P^C interval sequence for this example was established in subparagraph /(l) above, 
the terms, in figure 37 b, which gave rise to the thrice-appearing repetition in the interval sequence 
(—10 —15 +34) are found to be as follows: 

1st appearance (term numbers 12-16) 42 

2d appearance (term numbers 21-25) 34 

3d appearance (term numbers 25-29) 26 

Figure 37#. 

These sequences may be rearranged so as to bring the numbers in ascending order within 
columns. Thus: 

26 16 01 35 

34 24 09 43 
42 32 17 51 

Figure 3 7). 

The constant difference, 8, within the columns of this structure is, of course, the same constant 
difference as was found before, and corresponds with the width of the T-l matrix. It derives 
from the T-l matrix, as may be seen on referring to figure 37 a. The columns of the structure 
in figure 37 j are seen to be portions of the T-l matrix, lying in the following positions in that 
matrix: 




Figure 37fc. 



In the T-2 matrix these numbers fall in the following positions: 




26 


34 


16 


24 


01 


09 


35 


43 



Figure 37/. 



Now if the dimensions of the T-2 matrix were unknown , these numbers could nevertheless be 
placed in a skeletonized T-2 matrix as follows: 



26 


34 


42 


16 


24 


32 


01 


09 


17 


35 


43 


51 


Figure 37m(l). 
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and the block of numbers could be extended on both sides by referring to the T-l matrix in figure 
37a. Thus: 

‘ 50 

40 48 | 

25 33 41 49 I 

51 | 

Figure 37m(2), 



| 02 


10 


18 


26 


34 


42 






| 08 


16 


24 


32 








01 


09 


17 


03 11 


19 


27 


35 


43 


51 



This structure may next be extended by referring to the P^C sequence in figure 37 a, by 
pleting the partial columns of the structure. 



com- 



44 


| 02 


10 


18 


26 


34 


42 


50 


06 


14 


22 


30 


38 


46 


| 08 


16 


24 


32 


40 


00 

TJH 


1 05 


13 


21 


29 


37 


45 


01 


09 


17 


25 


33 


41 


49 


1 03 


11 


19 


27 


35 


43 


51 


07 


15 


23 


31 



Figcre 37m (3). 

Again the structure may be extended by referring to the T-l matrix. Thus: 
04 12 



20 


28 


36 


44 


02 


10 


18 


26 


34 


42 


50 


06 


14 


22 


30 


38 


46 


06 


14 


22 


30 


38 


46 


08 


16 


24 


32 


40 


48 


05 


13 


21 


29 


37 




05 


13 


21 


29 


37 


45 


01 


09 


17 


25 


33 


41 


49 














03 


11 


19 


27 


35 


43 


51 


07 


15 


23 


31 


39 


47 
















Figure 37m(4). 



















Noting the appearance of the term 06 in the 1st row and also in the 
latter may be transcribed as follows: 



04 


12 


20 


28 


36 


44 


02 


10 


18 


26 


34 


42 


50 


06 


42 


50 


06 


14 


22 


30 


38 


46 


08 


16 


24 


32 


40 


48 


32 


40 


48 


05 


13 


21 


29 


37 


45 


01 


09 


17 


25 


33 


17 


25 


33 


41 


49 


03 


11 


19 


27 


35 


43 


51 


07 


15 


51 


07 


15 


23 


31 


39 


47 r 

















Figure 37 m (5). 



2d row of the structure, the 



14 


22 


30 


38 


46 


05 


13 


21 


29 


37 45 


41 


49 








23 


31 


39 


47 





By referring to the T 1 matrix of figure 37a and the foregoing structure, the key for T-l can be 
recovered. It is 6-2-7-1-5-3-8-4. By referring to the P-+C sequence in figure 37a the key 
for the T-2 matrix just constructed may be established. It is 3-9-1-7-4-2-11-8-10-6-5. 

k. Applying this method to the messages solved in paragraph 26 d-e, the steps are as follows- 
I he width of the T-l matrix has been established as being 12. The P-^C interval sequence in 
figure 366 shows the repetition +3+5—14—11—3 appearing two times; the repetition 
+ 3 +5 -14 appearing three times; and the repetition -14 -11 appearing three times. The 
terms giving rise to these repetitions are arranged in a structure with ascending numbers within 
the columns. Thus: 



07 


10 


15 


01 










27 


13 


02 




31 


34 


39 


25 


14 


11 


43 


46 


51 


37 


26 


23 






Figure 36/. 
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+Tbe constant difference, 12, indicates a T-l matrix of 12 columns. The matrix is prepared: 



1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


01 


02 


03 


04 


05 


06 


07 


08 


09 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


20 


21 


22 


23 


24 


25 


26 


27 


28 


29 


30 


31 


32 


33 


34 


35 


36 


37 


38 


39 


40 


41 


42 


43 


44 


45 


46 


47 


48 


49 


50 


51 






























Figure 36 g. 













The terms within the columns of the structure in figure 36/ arc transcribed into row T s (of the 
skeletonized T-2 matrix) : 



07 




31 


43 


10 




34 


46 


15 


27 


39 


51 


01 


13 


25 


37 




02 


14 


26 






11 


23 



Figure 36ft(l). 



BT 

is to,-- 



This structure is extended by referring to the T-l matrix (figure 36<;): 





1 2 


3 


4 


5 


6 


7 


1 


07 


19 


31 


43 






a 


10 


22 


34 


46 






3 


03 15 


27 


39 


51 






4 


01 


13 


25 


37 


49 




5 




02 


14 


26 


38 


50 


6 






11 


23 


35 


47 



Figure 36A(2). 



Noting that the initial terms of the P— >C sequence in figure 36a (27 13 02) are present in 

this structure (in the 3d column) this gives the top of the T-2 matrix as coinciding with the 3d 
row of the structure. The P— >C sequence in figure 36a reads 27 13 02 43 46 . . .; the 

43 and 46 are also in the structure in figure 366 (2) in the 1st and 2d rows, column 5; hence the 
structure in figure 366(2) can be rearranged thus: 





03 


15 


27 


39 


51 










01 


13 


25 


37 


49 










02 


14 


26 


38 


50 


07 


19 


31 


43 


11 


23 


35 


47 


10 


22 


34 


46 











Figure 36ft (3). 



The structure may now be extended by referring to the P— >C sequence in figure 36a: 



35 


03 


15 


27 


39 


51 


05 


17 


33 


45 


01 


13 


25 


37 


49 


06 


24 


36 


48 


02 


14 


26 


38 


50 


07 


19 


31 


43 


11 


23 


35 


47 


10 


22 


34 


46 











Figure 36ft (4). 
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Thus, by referring alternately to the P-»C sequence and the T-l matrix the structure is extended 
to the following: 

35 03 15 27 39 51 ( 05 17 29 41 | 09 21 33 45 | 

33 45 | 01 13 25 37 49 | 06 18 30 42 | 12 24 36 48 | 

24 36 48 | 02 14 26 38 50 | 04 16 28 40 | 07 19 31 43 | 

07 19 31 43 | 11 23 35 47 | 08 20 32 44 I 10 22 34 46 

10 22 34 46 j 

Figure 36h(S). 

It will be noted that the first number to the right of each vertical bar is one of the numbers from 
1 to 12, indicating that all the columns of the T-l matrix are now represented in the T-2 structure. 
It is now easy to write the transposition key over the T-l matrix: 4-7-1-8-2-5-9-11-3-12-10-6. 
By following the numbers in the P^C sequence the transposition key for the T-2 matrix is 
given directly; it is the same as for the T-l matrix. 

I- (1) A third method for reconstructing the transposition keys will now be set forth. It 
will first be explained in connection with the artificial example in figure 37a. It has been noted 
how the width of the T-l matrix can be ascertained from a study of the P->C sequence; the work 
in connection with figure 37a and subparagraph e give an indicated width of 8 for the T-l matrix 
in this case. 

(2) Let the additive 8 (found in subpars. d and/) be applied to the entire P— >C sequence of 
figure 37a, and then let the identities between the two sequences be underscored and numbered, 
as shown in figure 37n: 



(A) P^>C sequence. 



j 20 06 48 33 15 144 30 21 03 39 (04 |42 32 17 51 

( . • ~ 3 

36 22 13 49 31 |34 24 09 1 43 | 26 16 01 35 1 

4 5 6 

28 14 05 41 23 [10 46 37 19 1 12 150 40 25 07 | 



18 08 45 27 1 02 38 29 11 47 

io n 



(B) P-»C sequence+8. 



( 28 14 56 41 23 |52 38 29 11 47 112 150 40 25 59 

f i 2 5 

44 30 21 57 39 |42 32 17 51 | 34 24 09 1 47 

4 5 ' 6 

36 22 13 49 31 |18 54 45 27 [ 20 58 48 33 15 1 



26 16 53 35 1 10 46 37 19 55 

Io“ ’■ IT 1 



H now the procedure explained in paragraph 16 k, 24c to/, and 25c to e is applied to the repetitions 
noted in figure 37n, it becomes clear that the T-2 matrix in this case must have 1 1 columns The 
transposition key for that matrix is then established, as follows: 2 



B 

A 

Chain. 



6 7 8 

5 4 10 

8 10 6 



9 10 11 

1 6 8 
5 3 9 



2 It is to be noted that the B sequence (that is, the P-»C sequence plus the additive) must be used as the 
base, otherwise the chain of equivalents will be a reversal of the correct chain. 
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This is a cyclic permutation of the key for the T-2 matrix; to obtain the actual key it is necessary 
merely to fix the position of one of the key numbers with, respect to the matrix. It is easy to 
find which number belongs at the extreme left or extreme right of the matrix. Only a few 
minutes experimentation with the key and the T-2 matrix gives the correct starting point for 
the key, which is found to be 3-9-1-7-4-2-11-8-10-6-5. 

(3) The recovery of the transposition hey for the T— 1 matrix is now a simple matter. Its 
width having been established as 8 columns, a mere transcription of the P-^C sequence numbers 
from the T-2 matrix into the T-l matrix gives the key 6-2- 7-1 -5-3-8- 4. The two keys and 
matrices are found to be different. 

(4) The procedure set forth in this subparagraph is applicable without modification to the 
case where the two transposition matrices are the same and have the same transposition key. 
This will be noted in the following demonstration of the recovery of the matrices and keys for 
the messages solved in paragraph 26 d and e by anagramming. It has already been shown how 
the width of the T-l matrix was ascertained as being 12 columns (subpar ../). The additive 12 
is then applied to the entire P^C sequence, identities are established between sections of the 
original sequence and sections of the sequence + 12, and these identical sections are equated in 
the usual manner, leading to the establishment of a cyclic permutation of the transposition key 
for the T-2 matrix. Thus (fig. 367) : 

1 2 3 

A. (P-C sequence) ST 13 02 43 lb 51 37 26 23 41 30 16 20 

B. (P-4 C sequence + 12) 39 25 14 55 58 63 49 38 35 53 42 28 32 

I 2 3 

4 5 6 

03 45 36 19 22 05 49 38 35 33 24 07 10 

15 57 48 31 34 17 61 50 47 45 36 19 22 

4 5 6 

7 8 9 

?5 01 48 31 34 39 25 14 11 17 06 50 47 

27 13 60 43 46 51 37 26 23 29 18 62 59 

~7 " ' 8 ” 9 

10 11 12 

21 12 40 44 29 liT~ 04 08 09 42 28 32 

33 24 52 56 41 30 16 20 21 54 40 44 

' io n 12 

Figure 36i. 



g 1 2 3 4 5 6 7 8 9 10 11 12 

A 8 5 12 7 9 4 1 2 11 6 3 10 

Chain . . ... - 1 8 2 5 9 11 3 12 10 6 4 7 



Since sections 1, 4, and 7 of the P^C sequence contain 5 terms (=long columns), the other 
sections only 4 ( = short columns), it follows that the key numbers 4-7-1 go to the left and the 
actual key for the T-2 matrix is 4-7-1-8-2-5-9-1 1-3-12-10-6. Since the number of elements 
in this key is the same as in the key for the T-l matrix, it is likely that the same key is employed 
for both transpositions. Simple experiment will quickly verify this assumption and the trans- 
position matrices for the first of the 5 messages of paragraph 26 d may be seen m the following 
(figure 36/): 
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Cryptogram.., IAALN E 0 F S G etc. 

E->C sequence.... 27 13 2 43 46 51 37 26 23 41 etc. 

Figure 38;. 

( V A , fc T th and P° ssibl y the most elegant solution to the problem of reconstructing 

bc -f 

tat and the second transpositions, ripcotivaly, bo sS™ as ™ JTT* * *" ““ 

1. Term number « 02 n, nr „„ „„ .. .. 



01 

03 

27 


02 

15 

13 


03 

27 

02 


04 

39 

43 


05 

51 

46 


06 

05 

51 


07 

17 

37 


08 

29 

26 


09 

41 

23 


10 

09 

41 


n 

21 

30 


12 

33 

16 


13 

45 

20 


14 

01 

03 


15 

13 

45 


16 

25 

36 


17 

37 

19 


18 

49 

22 


19 

06 

05 


20 

18 

49 


21 

30 

38 


22 

42 

35 


23 

12 

33 


24 

24 

24 


25 

36 

07 


26 

48 

10 


27 

02 

15 


28 

14 

01 


29 

26 

48 


30 

38 

31 


31 

50 

34 


32 

04 

39 


33 

16 

25 


34 

28 

14 


35 

40 

11 


36 

07 

17 


37 

19 

06 


38 

31 

50 


39 

43 

47 


40 

11 

21 


41 

23 

12 


42 

35 

40 


43 
47 

44 


44 

08 

29 


45 

20 

18 


46 

32 

04 


47 

44 

08 


48 

10 

09 


49 

22 

42 


50 

34 

28 


51 

46 

32 



Figure 36 k 

- — - « 
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A casual examination of these three rows of numbers discloses an interesting invariant relation- 
ship between any pair of superimposed numbers in rows 1 and 2 and in rows 2 and 3. For 
instance, take the very first pair, ^ in rows 1 and 2; in rows 2 and 3 the same pair of super- 
imposed numbers will be found (under term No. 14). This same relationship exists between all 
the superimposed pairs in rows 1-2 and 2-3. 

(2) Given only the third row of numbers in figure 36 k, that is, the P->C 2 sequence (which 
has heretofore been designated merely as the P— »C sequence), obtained as a result of a solution 
by superimposing and anagramming several messages, it is not difficult to reconstruct the second 
row, the P— >C] sequence. The width of the T-l matrix can be ascertained by either of the two 
methods indicated in subparagraphs e and/. It is now known to be 12. A 12-column matrix 
is therefore constructed, containing 51 cells numbered in the normal manner. This will, of 
course, give the T-l matrix seen in figure 36/ but without the transposition key or the letters 
in the cells. Thus: 
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02 


03 


04 


05 


06 


07 
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10 
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16 
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31 


32 


33 


34 


35 


36 


37 

49 


38 

50 


39 

51 


40 


41 


42 


43 


44 


45 


46 


47 


48 


J 



















Figure 361 



The invariant relationship pointed out in subparagraph (1) above may now be used to estab- 
lish the T-l key. Since the key is known to contain 12 elements, a start may be made with 
any one of 12 possibilities. Suppose that the key begins with 1. The first five terms in the 
P-»C] sequence would be as indicated herewith: 

1. Term number oi 02 03 m 06 

2. P-^Ci sequence 01 13 25 37 49 

3. P->C 2 sequence 27 13 02 43 46 

Two “conflicts” or contradictions arc at once manifested: jj] in rows 1 and 2, in rows 2 and 3; 

also, jV, in rows 1 and 2, j'.j in rows 2 and 3. The conclusion is obvious that the key number 1 

does not occupy the 1st position in the transposition key. Suppose key number 1 belongs in the 
2d position in the key. The superimposed sequences are then as follows: 



1. Term number 01 02 03 04 05 

2. P->Ci sequence 02 14 26 38 50 

3. P-^C 2 sequence 27 13 02 43 46 

01 26 02 02 
Here again two conflicts are noted: in rows 1 and 2 ’ 02 in rows 2 and 3; ^ in rows 1 and 2, , } Z 

in rows 2 and 3. Only a single contradiction is sufficient to permit of discarding an hypothesis. 
The key number 1 does not occupy the 2d position in the key. A trial is made of the 3d position 
for key number 1. The results are as follows: 



1. Term number 


_ 01 


02 


03 


04 


05 


2. P— >Ci sequence.. 


03 


15 


27 


39 


51 


3. P— >C 2 sequence 


27 


13 


02 


43 


46 





REF ID : A59439 




70 



Here there are no contradictions and one check or corroboration: ™ in rows l and 2j 03 in rowg 

2 and 3. If key number 1 really occupies the 3d position in the key, then the superimposition 
i ata given m the last set of rows of superimposed numbers may be employed, by transferring the 
data to the proper positions in the skeletonized figure 36m (1) : 

1. Term number. 



2. P— >Ci sequence. 

3. P-->C 2 sequence. 



01 

03 


02 

15 


03 

27 


04 

39 


05 

51 


06 

05 


07 


08 


09 


10 


u 


12 


13 


14 

01 


15 


16 


17 


27 


13 


02 


43 


46 


51 


37 


26 


23 


41 


30 


16 


20 


03 


45 


36 


19 


18 


19 


20 


21 


22 


23 


24 


25 


26 


27 


28 


29 


30 


31 


32 


33 


34 


22 


05 


49 


38 


35 


33 


24 


07 


10 


02 

15 


01 


48 


31 


34 


04 

39 


25 


14 


35 


36 
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39 


40 


41 


42 


43 


44 


45 


46 


47 


48 


49 


50 
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11 


17 
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50 


47 
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40 


44 
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42 


28 
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FlGURE 36771 (1) 



It then becomes at once possible, by referring to the T-l matrix, 
P-*Ci sequence. Thus: 



i. 


Term number 


01 


02 


03 


2. 


P— >Cq sequence.... 


03 


15 


27 


3. 


P— »C 2 sequence.... 


27 


13 


02 






18 


19 


20 






49 










22 


05 


49 






35 


36 


37 






40 










11 


17 


06 



04 
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07 


08 


09 


10 


39 
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05 


17 


29 


41 




43 


46 


51 


37 


26 


23 


41 


21 


22 
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25 


26 
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to insert more numbers in the 
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Figure 36m (2) 

The new placements now permit of placing numbers in the P->C t sequence. For example, ^ 
in rows 1 and 2 permit of placing the number 07 above the number 17 in the P->C 2 sequence; 
in rows 1 and 2 permit of placing the number 08 above the number 29 in the P->C 2 sequence! 
and so on. In only a few moments the entire P-^Cj sequence can be established. Thus: 



1. Term number. 

2. P— sequence. 

3. P— »C 2 sequence 


01 

03 

27 


02 

15 

13 


03 

27 

02 


04 

39 

43 


05 

51 

46 


06 

05 

51 


07 

17 

37 


08 

29 

26 


09 

41 

23 


10 

09 

41 


12 

21 

30 


12 

33 

16 


13 

45 

20 


14 

01 

03 


15 

13 

45 


16 

25 

36 


17 

37 
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18 

49 

22 


19 

06 

05 


20 

18 

49 


21 

30 

38 


22 

42 

35 


23 

12 

33 


24 

24 

24 


25 

36 

07 


20 

48 

10 


27 

02 

15 
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14 

01 


29 
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48 


30 

38 

31 


31 
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34 
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04 
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25 


34 

28 
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39 

43 

47 


40 

11 

21 


41 

23 

12 


42 

35 

40 


43 

47 

44 


44 

08 

29 


45 

20 

18 


46 

32 

04 


47 

44 

08 


48 

10 

09 


49 

22 

42 


50 

34 

28 
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46 

32 



Figure 36n. 



(3) The determination of the T-l key is now a very simple matter. Since it is known that 
the key has 12 numbers, it is only necessary to note in the P >C, sequence the relative order of 
the numbers 1 to 12. It is as follows: 



1 2 3 ■* 5 6 789 10 11 12 

3 5 9 1 6 12 2 4 7 11 8 10 



> 
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This is merely the inverse of the actual key ; the latter may be obtained by inversion. Thus: 

1 2 3 4 6 6 7 8 » 10 11 12 

4 7 1 8 2 5 9 11 3 12 10 6 

Comparison of this key with the T-l key shown in figure 36^ will establish the identity of the two. 

The determination of the T-2 key is obvious, having the T-l at hand. In this case both matrices 
and keys are identical. 

a. Attention will be directed to a further interesting phenomenon in this case. Referring to 
figure 36a, if chains of equivalents are constructed between elements of the 1st and 3d rows only, 
the following two chains are obtained: 



01 27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28 

04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46 



Figure 36o. 



All the terms of the P— >C 2 sequence are represented, except the number 24, which stands by 
itself. If now each of these chains is slid against itself, when properly juxtaposed, the super- 
imposed pairs are identical with those in rows 1 and 2 in figure 36a. Note the following: 



( 1 ) 



27 15 45 18 22 35 11 30 31 34 14 03 02 13 20 49 42 40 21 38 50 28 

02 13 20 49 42 40 21 38 50 28 01 27 15 45 18 22 35 11 30 31 34 14 

[04 43 44 29 48 09 23 33 25 07 37 06 51 32 39 47 08 26 10 41 12 16 36 17 19 05 46 

( ^\39 47 08 26 10 41 12 16 36 17 19 05 46 04 43 44 29 48 09 23 33 25 07 37 06 51 32 

Figure 36p. 



The application of the foregoing phenomena in the case under study is obvious. Here it is not 
even necessary to ascertain the width of the T-l matrix before proceeding to try to establish 
the T -l key. Of course, the number of chains which may be established will vary with the 



6 



01 02 03 04 
09 10 11 12 
17 18 19 20 
25 26 27 28 
33 34 35 36 
41 42 43 44 
49 50 51 I — 



05 06 07 08 
13 14 15 16 
21 22 23 24 
29 30 31 32 
37 38 39 40 
45 46 47 48 
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A (=T-1) 



11 8 



04 12 20 28 36 44 02 10 18 26 34 
42 50 06 14 22 30 38 46 08 16 24 
32 40 48 05 13 21 29 37 45 01 09 
17 25 33 41 49 03 11 19 27 35 43 
51 07 15 23 31 39 47 j 



C (=T-2) 

Figure 37o. 
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specific matrices and keys, but the general principles herein presented may nevertheless be 1 
applied. In some cases it may be necessary to juxtapose two different chains obtained by 
equating terms from rows 1 and 3, rather than juxtaposing one chain against itself. Only a 
few minutes experimentation will be necessary to establish contradictions which will permit of 
discarding fallacious hypotheses. 

o. (1) In the foregoing explanation, the two transposition keys and matrices were identical. 
Even when they are different the same principles, with minor modifications, may be applied. 

The matrices and keys of figure 37a will again be employed to demonstrate the necessary modi- 
fications. 

(2) First, prepare the two matrices with consecutive numbers in the cells of both matrices, 
as shown at A and B in figure 37o and then prepare the T-2 matrix, shown at C. 

(3) Write the P— >Ci sequence for T-l, under it write the P— for T-2, and under 
the latter write the P— »C 2 sequence for the final cryptogram. Thus: 



1. 


Term number... 


01 


02 


03 


04 


05 


06 


07 


08 


09 


10 


11 


12 


13 


14 


2. 


P— »Ci sequence for T-l 
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20 
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44 
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26 


34 


42 
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P— »Ci sequence for T-2... . 


... 03 


14 


25 


36 


47 
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17 


28 


39 


50 
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23 


34 
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P— *C 2 sequence . 
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06 
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44 


30 
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42 


32 
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Figure 37p. 


























Note, now, the invariant relationship between rows 1-2 and 3-4. The same phenomenon is 
here manifested as was encountered in the preceding case where the T-l and T-2 matrices and 
keys were identical. It follows, therefore, that the principles elucidated under subparagraph m 
may be applied, with some modifications, also to the case where different keys and matrices are 
employed for double transposition. The width of the T-l matrix may be ascertained in the 
manner already indicated; an assumption is made as to the position occupied by key number 1 
of the T-l key; this assumption provides data for making an assumption as to the width of the 
T-2 matrix. When the correct pair of assumptions is made, the data in rows 1 and 2 are cor- 
roborated by those in rows 3 and 4. From that point on the rest is easy and follows along the 
same lines as before. 

p. (1) The procedure will be illustrated by employing the P— »C sequence in figure 376 
(which is the same as that labelled P— »C 2 sequence in figure 37p), it being assumed that nothing 
is known about the matrices, and that the sequence was obtained from a solution by superim- 
posing and anagramming several messages of identical length. 
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(2) The width of the T-l matrix is established as 8 and the T 1 matrix set down: 
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Figure 37«. 



(8) Assuring that key number 1 occupies t^ Im^posRimm tlm ^1 kei^ the numbemaro 

:r 2 r : a. u. 



1 , Term number. 



3. P-»C, sequence for T-2. 



01 


02 


03 


04 


05 


06 


07 


08 


09 


10 


11 


12 


13 


14 


01 


09 


17 


25 


33 


41 


49 














03 


20 


06 


48 


05 

33 


15 


44 


30 


21 


03 


39 


04 


42 


32 


17 


16 


16 


17 


18 


19 


20 


21 


22 


23 


24 


25 


26 


27 


28 










07 








02 








01 


35 


51 


36 


22 


13 


49 


31 


34 


24 


09 


43 


26 


16 


01 


29 


30 


31 


32 


33 


34 


35 
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37 


38 


39 


40 


41 


42 


28 


14 


05 


06 

41 


23 


10 


46 


37 


19 
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50 


40 


04 
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41 
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Figure 37r 
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(4) An attempt is now made to construct^ T 2 i matm 06 tiie nuttrn 

and 07 and between “ “ d “ ^ tor key number 1 and the procedure repeated, 
alTwithout good resufts. Note what happens when position 4 is assumed for key number 1 in 
the T-l key: 



! 







1. Term number 

2- P-»Cj sequence for T-l. 

3- P-*C 2 sequence for T-2. 



01 

04 


02 

12 


03 

20 


04 

28 


06 

36 


06 

44 


07 


08 


09 


10 


n 


12 


13 


14 


03 

20 


06 


48 


33 


15 


06 

44 


30 


21 


03 


39 


01 

04 


42 


32 


17 


16 


18 


17 


18 


19 


20 


21 


22 


23 


24 


25 


26 


27 


28 




05 


























51 


36 


22 


13 


49 


31 


34 


24 


09 


43 


26 


16 


01 


35 


29 


30 


31 


32 


33 


34 


35 


36 


37 


38 


39 


40 


41 


42 


04 


















02 

12 










28 


14 


05 


41 


23 


10 


46 


37 


19 


50 


40 


25 


07 


43 


44 


46 


46 


47 


48 


49 


50 
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11 
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Figure 37 r (2). 

t-2 ZT^:::;:lz d z r,‘o“ 5 e n,ture ,°' those ^ •*» Th , 

row 3 can accommodate a short column of 4 anrl l & ’ S1 , nce ^ e . In j j< ‘ rva ^ between 04 and 02 in 

05 and 04 can accommodate 2 short columns of 4 lettera ZcU°] 5 thc inter ™l between 

between 03 and 06 06 and 01 01 and o'-, u 1 long column of 5; the intervals 

Only 2 matrices can be constructed of 51 Ltere wiThTo 1 ^ ° f 5 letters oach ' 

4 letters. They are: Wlth 1<>ng Columns of 5 and ^ort columns of 



Key of 11 I 7 ( lon g) X5= 

[4 (short) X4= 

Key of 12 f 3 ( lon S) X5 = 

(9 (short) X4=: 



35 

16 51 



Each of these T-2 matrices is tested as a possibility 



15 

36 51 



12 ll l! u °S “ S S Vo 21 22 b. 02 03 04 05 06 07 08 09 >0 U 12 I 

34 £ 36 % S S 2 V £ S £ % ” * * * « f » ” S 2 

46 46 47 48 49 50 51 , _ % ^ j!» 40 41 42 43 44 « 46 4 7 48 

K ” " I 

A B 

Figure 37r (3). 

u> JZVLigz n,m : b T “ “ lum,,s ***. *. 4 > ^ * « b. 

and many at *> ™ * No oont rK ,icti„„. 
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1. 


Term number 


01 


02 


03 


04 


05 


06 


07 


08 


09 


10 


11 


*12 


13 


u i) 


2. 


F-^Cj sequence for T-l 


.... 04 


12 


20 


28 


36 


44 












42 


50 


jj 


3. 


P->C! sequence for T-2 
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Figure 37r (4). 
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(7) In the first place note, in row 2, the constant difference 8, giving many corroborations || 

that the width of the T-l matrix is 8; in the second place no conflicts whatever become manifest I 

between the pairs of rows. Thus, the validity of the assumption of a T-2 matrix with 11 columns lj 

is well established. The rest follows quite readily, with the final result that figure 37r becomes j j; 

completed, and the recovery of both keys is a simple matter. In fact, both keys may be estab- I 

lished from a simple study of rows 2 and 3 of the final figure (which would, of course, be identical j | 

with that shown in fig. 37 p and need not here be repeated) . p 

q. A careful study and good grasp of the principles and methods elucidated in this paragraph I 

will be sufficient to indicate to the student that when, as a result of a close study of several ; r 

messages in the same keys, partial C ~ >P sequences become available, the entire C— »P sequence ij 

or sequences can usually be reconstructed from the partial sequence or sequences and the mes- | 

sages solved without too much difficulty. For instance, suppose it has developed that the j| 

enemy has become addicted to stereotypic beginnings, so that the first few letters of a message if- 

or of several messages can be reconstructed with some assurance of certainty. The construction aj 

of partial C— >P sequences and their completion by means of the principles set forth, especially J 1 

those presented in subparagraphs m-p, may result in reconstruction of the complete C— »P if 

sequences and ultimate recovery of the transposition key or keys. | 

28 . Special cases of solution of double transposition ciphers. — a. When the double trans- J 

position system is employed in the field and is used for a voluminous traffic it is almost inevitable I 

that certain situations will arise which make possible a rather easy solution. Aside from the case 1 

in which several cryptograms of identical length and in the same key are intercepted, other cases I 

of a special nature may arise. Some of these will be discussed in this paragraph . j 

b. First, there is the case in which an inexperienced cryptographic clerk fails to execute the I 

double transposition properly and causes the transmission of a cryptogram which is only a single 1 

transposition. The solution of this message will be a simple matter and will, of course, yield the | 

key. If the key is the same for both transpositions it is obvious that this will permit the reading t 

of all other messages even though the latter have been correctly cryptographed. The only 1 

difficult part of the matter is to find among a large number of intercepted cryptograms one which I 

involves a blunder of this sort. When the cryptanalyst lias, as a result of considerable experi- J 

ence, become adept in the solution of transposition ciphers the work of testing cryptograms to i 

ascertain whether or not they involve single columnar transposition is not difficult and goes quite § 
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rapidly. For only a few minutes are sufficient to give him the “feeling” that the cryptogram is or 
is not solvable by single transposition. He might not be able to point out any specific indications 
which give him this feeling if asked to do so; nevertheless it must be recognized that his intuition 
is alone sufficient to tell him when there is hope of solution along this line and when further work 
upon the hypothesis of single transposition is useless. 

c. (1) Next comes the case in which the enciphering rectangles of a double transposition 
cryptogram happen to be perfect squares (that is, both T-l and T-2 rectangles are perfect 
squares) . In this case, not only is such a cryptogram detectable at once, since the total number of 
letters is the square of the number of elements in the key, but also the cryptogram can be solved 
in a very simple manner. For the cryptogram now represents a case in which a completely-filled 
rectangle has been employed, and moreover there is no need even to assume various widths. 

(2) Given the following cryptogram of 49 letters (7X7) as an example, the text is tran- 
scribed as shown in figure 39a and retranscribed as in figure 395. 
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Cryptogram 

12 3 4 5 6 7 

U S R U 0 R E 

C H G W E F E 

T I A D R E M 

R E S D D N N 

NTOHNCN 
0 0 E 0 D 0 V 

E L D E I E E 

Figurk 39a. 



UCTRN OES 
NOEOE RDN 

1 2 3 4 5 6 7 

U C T R N 0 E 

S H I E T 0 L 

R G A S 0 E D 

Of DDNOE 
OERDNDI 
R F E N C 0 E 

E E M N N V E 

Fiogrk 395. 



HI ETOLR G 

D I RFENC 0 

2 6 1 5 3 7 4 

COONTER 
H 0 S T I L E 

G E R 0 A D S 

WOUNDED 
E D 0 N R I D 

F 0 R C E E N 

E V E N M E N 

Figure 39c. 



ASOE DUWDD 
EEEM NNVE 

2 6 1 5 3 7 4 

H 0 S T I L E 

F 0 R C E E N 

COUNTER 
E D 0 N R I D 

G E R 0 A D S 

EVENMEN 
WOUNDED 

Fiousi 394. 



(3) The columns of figure 395 are now anagrammed, as in figure 39c, and the rows rearranged, 
as in figure 39 d. 

d. When the enciphering rectangle is not a perfect square but nevertheless a complete rec- 
tangle, solution of a single cryptogram becomes somewhat more difficult. Here the columns are 
all equal in length, since the last row of the rectangle is completely filled. Two cases will be 
considered; first, when the width of the rectangle is a multiple of the depth, or number of letters 
in the columns, and second, when the depth is a multiple of the width. 

e. (1) Taking up the first case, note the following encipherment; 



6 


2 


10 


1 


7 


4 


9 


8 


3 


5 


w 


H 


E 


N 


w 


I 


L 


L 


F 


I 


1 


2 


3 


4 


5 


6 


7 


8 


9 

_ 


10 


R 


s 


T 


s 


Q 


U 


A 


D 


R 


0 


ii 


12 


13 


14 


15 


16 


17 


18 


19 


20 


N 


R 


E 


A 


c 


H 


G 


0 


L 


D 


21 


22 


23 


24 


25 


26 


27 


28 


29 


30 


E 


N 


V 


I 


L 


L 


E 


T 


_ 

0 


N 


31 


32 


33 


34 


35 


36 


37 


38 


39 


40 


I 


G 


H 


T 


A 


D 


V 


I 


s 


E 


41 


42 


43 


44 


45 


46 


47 


48 


49 


50 



6 


2 


10 


l 


7 


4 


9 


8 


3 


5 


N 


S 


A 


I 


T 


H 


s 


R 


N 


G 


4 


14 


24 


34 


44 


2 


12 


22 


32 


42 


F 


R 


■ 

L 


0 


s 


I 


u 


H 


L 




9 


19 


29 


39 


49 


6 


16 


26 


36 




I 


0 


D 


N 


E 


w 


R 


N 


E 




10 


20 


30 


40 


50 


1 


a 


21 


31 


41 


W 


Q 


c 


L 


A 


L 


D 


0 


T 


I 


5 


15 


25 


35 


45 


8 


18 


28 


38 


48 


L 


A 


G 


E 


V 


E 


T 


E 


V 


H 


7 


17 


27 


37 


47 


3 


13 


23 


33 


43 




T-l Rectangle 



T-2 Rectangle 



P->C sequence 
Cryptogram — 



77 



34 39 40 35 37 14 19 20 15 17 32 * 31 33 33 2 6 1 8 3 42 46 41 48 43 

IONLESROQANLETVHIWLEGDIIH 

7 44 49 50 45 47 22 26 21 28 23 12 16 U 18 13 24 29 30 25 » 
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If the P-rC sequence is earned it wilt be found that sections thereof fall into two cate- 
gories, as follows; 
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(2, There is obvionsly a definite regularity in the composition 0 ,f the ^ 
letters corresponding to the (A or B, 

corresponding to the numbers m example in category B the letters correspond- 

respcctively) will be assembled correctly too Fo J ch section are sequent in 
mg to the numbers occupying the third.* jr , L nding to the numbers occupying the 

the plain-text rectangle; in categoiy A - Moreover all the letters in each section 

first and fourth positions in each sectmn coming from the 

come from the same row m the T rectang • ^ * be rearrange d by experiment to 

same row can be identified, there will b pairs of sections, 

form plain text, and the key for this rearrangement wfil jpty tc m*U ot P No . 

For example, the message in this section." These two 

i sc, in the second section, the U (r->o sequence 4 

sections come from the same row and the letters may be anagrammed. 



1 2 3 4 5 

S R 0 Q A 



B 7 8 9 10 

and S U R D T 



2 1 6 

or ~ or ° r . „ _ 

8 6 10 1 4 7 5 



8 
or 
9 2 



RSTSQUADRO 

Experiment may new be made with two other sections, applying the transposition. Thus-. 
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T he various rows are now assembled in sequence, giving the following: 

WHENWILLFI 

kstsquadro 

nreachgold 

envilleton 

ightadvise 

The transposition key can now be reconstructed with ease. 

(3) The cryptanalyst in this case must, of course, make an assumption as to the width of 

h r r apply the method - with a 

f( ‘ 10 ^ 5 ° r 5X10 su ^ est themselves. The process of finding cipher groups which 

pairs ° n the f me row is one of “cut and try.” If there is a single Q and a sfnghfu in the 
message, the initial pair of groups is obvious. 

line/ofTflr' the , depth ° f th e rectangle is a multiple of the width, solution follows along the 
lines of the preceding case. Takmg the same message as before, note what happens in^enri- 
p crment with a rectangle of 5 columns containing 10 letters each: 
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It is obvious that if the 3d, 9th, 1st, 7tli, and 5th columns are made sequent, good text will be 
produced within the 5 rows. Thus: 

1 23456789 10 ) [39175 

TTRLQNSOSE R S T S Q 

EOWHWDNLH G > W H E N W 

EINDCEASR V *N R E A C 

DHUIOARTAG UADRO 

LVIEILFILN) ILLFI 

The subsequent steps are obvious. Here again in solving an unknown example it would be 
necessary to test out various assumptions with respect to the dimensions of the rectangle before 
attempting to apply the method outlined. 

g. Whenever this simple relationship between the width and depth of the rectangle obtains, 
that is, when one dimension is a multiple of the other, solution of a single cryptogram is relatively 
easy. The reason for this is not hard to see. When the enciphering rectangle is a perfect square, 
every column of the T-2 rectangle is composed of letters which all come from the same row of 
the T-l rectangle. Hence solution is in this case the same as though a false double transposition 
were in effect, with merely the columns and the rows of a single rectangle shifted about. When the 
width of the transposition rectangle is twice the depth, a column of the T-2 rectangle contains 
half the letters appearing on one row of the T-l rectangle ; two columns therefore contain all the 
letters belonging in the same row of the T-l rectangle. If the width were three times the depth, 
then three columns of the T-2 rectangle would contain all the letters belonging in the same row 
of the T-l rectangle, and so on. When the width is half the depth, a column of the T-2 rectangle 
contains all the letters appearing in two rows of the T-l rectangle; when the width is one-third 
the depth, a column of the T-2 rectangle contains all the letters appearing in three rows of the 
T-l rectangle, and so on. But when this multiple relationship no longer obtains, solution becomes 
more difficult because each column of the T-2 rectangle is composed of letters coming from sev- 
eral columns of the T-l rectangle, in an irregular distribution. Solution is, of course, most diffi- 
cult when incompletely filled rectangles are used. However, although solvable, even in the case 
of a single message, the solution will not be dealt with in this text. 







Section VI 



Special designs or geometric figures 

Reconstruction of transposition matrix 



PRINCIPLES OF MATRIX RECONSTRUCTION 



c 29 / S P ecial designs or geometric figures.— a. It is impossible here to elucidate and demon- 
strate by example all the methods which may be used for the solution of cryptograms produced 
by the many various types of transposition designs or geometric figures other than the simple 
ectanguhir ones thus far treated. Reference may be made to such matrices as triangles ZZ 
zoids and polygons of various symmetrical shapes. Most of these matrices, however arc imprac- 

b° 2S COrreSPOr nCe . in Tf CaS6 ’ S ° that n ° attention need be given them in this text. 
b. If such designs were used, although it might be difficult to solve a single or even a few 

messages in the same key, the general solution described in paragraph 26 is applicable whenever 

most onhMe^ 68 ^ 68 ° f ldent Jf al l en gtbs but in the same key are available for study. Since 
that If h designs are of a fixed or inflexible character with regard to the number of letters 
the mod be acc0rnmodaled Wlth °ne application of the design to the plain text to be enciphered 

id0ntiCaI n ngth “ ^ Same k6y is by n ° means an ^ 
usual circumstance. The general solution can usually be depended upon to yield the answer to 

cryp ograms of this category but it then becomes advisable to try to ascertain the exact nature of 

the specific design or geometric figure employed, that is, to reconstruct the ^Son lS 

tor this purpose a general method will be indicated by means of a specific example leavffig other 

ca 868 -^ 0 ^ be mgenuity of the student after he has learned the general method 

30. Reconstruction of transposition matrix.— a. Assume that the enemy is emplovimr an 

■mknown geometac figure of rafter email dimensions so that it appears from a study of tS“lfflc 

85 ‘TT A crypk>sram *» 

TiwriV Z a T f letterS ’ Whlch Sectlons are tben superimposed, as shown below 

4 Sem me ? *" IH ? S " Cti ° nS ° f 85 le ‘ tos “<*• I»“ • fka! secZ oibli 

y letters. I he final section will be dealt with later. 
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b. The anagramming process is applied to the superimposed complete sections, using the 
letter J in the first section as a starting point and building up text on either side, until the follow- 
ing partially reconstructed text is obtained: 

40 34 45 85 2 61 20 28 53 10 69 79 41 35 46 84 3 62 21 29 54 11 

ACHEDROADJUNCTIONFIVEF 

TEFARMXSECONDBATTALION 

BATTALI0NT0VICINITY0FH 

c. Examining the numbers forming this partial C-*P sequence, note the following sections 
of the sequence: 

40 34 45 85 2 61 20 28 53 10 . . . 

41 35 46 84 3 62 21 29 54 11 

They show a quite definite relationship, leading to the suspicion that the C— »P sequence is 
systematic in its composition . The numbers are then written down on cross-section paper so that 
consecutive numbers appear on the same level, as shown in figure 40-A: 



C->P sequence. 



Text. 



Matrix reconstruction diagram. 




Figure 40-A. 



d. From this skeleton of what may be termed the matrix-reconstruction diagram it is possible 
to derive direct clues for the continuance and completion of the C-»P sequence and the text of 
the message. For example, it would appear that the very next column to the left should be 78, 
the one to the left of 78 should be 68, the one to the left of 68 should be 9. Trial gives the 
following: 

9 68 78 40 34 45 85 2 . . . 

SREACHED. . . 

FTATEFAR . . . 

0URBATTA. . . 

To the right of column 11 should come columns 70 80 42 36 47. Thus: 

29 64 11 70 80 42 36 47 . . . 

VEFIVESE. . . 

I 0 N T H’l R D . . . 

0FHARM0N. . . 
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This, of course, speeds up the work involved in the anagramming process and when completed the 
text, the C— »P sequence, the P-»C sequence, and the matrix reconstruction diagram are as 
shown in figure 40-B. In the cells of the diagram there have been inserted in the upper left 
hand comer small numbers in italics, the latter numbers being merely the term numbers 
applying to the C-VP sequence. 

e. The matrix-reconstruction diagram in figure 40-B shows a total of 7 levels of numbers. 
Let the term numbers corresponding to the consecutive C-^P sequence numbers on the 
same level in the diagram be set down. Thus, for the C-^P sequence numbers 4 to 16, inclusive, 
on the first level the term numbers are: 

C-»P sequence number 4 5 6 7 8 9 10 11 12 13 14 15 16 

Term number 1 3 7 13 21 31 43 55 65 73 79 83 85 

On the second level there are two sets of consecutive C->P sequence numbers, those from 48 
to 58, inclusive forming one set, those from 64 to 74, inclusive forming the other set. Two series 
of term numbers are therefore derived: 
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What has been said of the 2d level applies also to the remaining levels, and the term numbers 
are therefore set down in the following tabular form: 
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Figure 41; 



j. There are in all 13 sets or series of consecutive C->P sequence numbers, indicating 
that the transposition matrix has 13 columns, the number of letters in each column corresponding 
with the number of different terms in each series. Thus, there is a column of 13 letters, 2 
columns of 11 letters, 2 columns of 9 letters, and so on. This leads directly to the idea of a 
very symmetrical matrix of the form shown in figure 42-A. 
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Figure 42-A. 



g. The recovery of the transposition key (for the columns of figure 42-A) is now a simple 
matter. Referring to the P— »C sequence shown in figure 40-B, and noting the various columns 
in figure 42-A in which successive numbers of the P— »C sequence fall, the key number 1 of the 
transposition key obviously applies to the column containing P^C sequence numbers 26-38-50; 
the key number 2 obviously applies to the column containing P-»C sequence numbers 1—3—7—13— 
21-31-43-55-65-73-79-83-85; and so on. The complete transposition key and the matrix are 
shown in figure 42-B. 
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Figure 42-B. 

h. The solution of the incomplete section of the message (the last 79 letters) now becomes a 
simple matter, since the matrix and the transposition key are both known. The matter can be 
handled as if simple transposition were involved, by outlining the matrix to contain exactly 79 
letters and inscribing the cipher text in the columns in key-number order. 

i. The foregoing principles and procedure will be found quite valuable not only in facili- 
tating the anagramming of the text in its initial stages (as in subparagraph d) but also in recon- 
structing various types of matrices based upon symmetrical designs used with single transpo- 
sition (subparagraphs e—g). It should be noted that the number of levels in the reconstruction 
diagram corresponds with the number of different-length columns in the matrix; the number of 
different categories of term numbers (as in figure 41) corresponds with the number of columns 
in the matrix. 




Section VII 
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SOLUTION OF GRILLES 

Paragraph 



Revolving grilles _ _ 31 

Solution of example 32 

Concluding remarks on the solution of revolving grilles 33 

Indefinite or continuous grilles . 34 



31. Revolving grilles. — a. In tliis type of grille 1 apertures are distributed among the cells 
of a square sheet of cross-section paper in such a manner that when the grille is placed upon a 
grid (a sheet of cross-section paper of the same size as the grille) certain cells of the grid are dis- 
closed; then when the grille is turned three times successively through angles of 90° from an 
initial position upon the grid, all the remaining undisclosed grid cells (or all but the central 
grid cell) are disclosed in turn. Correspondents must, of course, possess identical grilles and they 
must have an understanding as to its initial position and direction of rotation, clockwise or 
counterclockwise. There are two procedures possible in using such a grille. (1) The letters of 
the plain text may be inscribed successively in the grid cells through the apertures of the grille; 
when the grid has been completely filled the grille is removed and the letters transcribed from 
the grid according to a prearranged route. (2) All the letters of the plain text may first be 
inscribed in the grid cells according to a prearranged route and then the grille applied to the 
completely-filled grid to give the sequence of letters forming the cryptogram. The two methods 
of using the grille are reciprocal; if the first-described method is used to encipher a message, the 
second is used to decipher the cryptogram, and vice versa. The first of the two above-described 
methods, the one in which the plain text is inscribed through the apertures, will here be referred 
to as the alpha method; the second method will be referred to as the beta method. 

b. The number of letters in a cryptogram enciphered by such a device is either a perfect 
square, when the grille has an even number of cells per side, or is 1 less than a perfect square, 
when the grille has an odd number of cells per side, in which case the central cell of the grid is 
not disclosed and hence remains unfilled . 2 

c. The manner of construction and the method of use of a grille entails certain consequences 
which can be employed to solve the cryptograms and to reconstruct the grille itself. The student 
who wishes to get a thorough grasp of the underlying principles to be explained will do well to 
prepare a grille 3 and study the properties which characterize cryptograms produced by its use. 
Three principles will be brought to bear in the solution of grille ciphers of this type and they 
will be demonstrated by reference to the grille and message shown in figure 43. 

1 See Special Text No. 166, Advanced Military Cryptography, sec. V. 

2 Of course, the cryptogram may consist of the letters produced by several applications of the same grille. 
For example, if a message of 170 letters is to be enciphered by a grille accommodating only 36 letters at a time, 
the message is divided up into 5 sections of 36 letters each (10 nulls being added to make the total a multiple of 
36). The total number of letters (180) here shows no properties of the type noted. Again, if the grille has a 
capacity greater than the number of letters to be enciphered, certain of the grid cells may be cancelled, so that 
the number of letters in the final cryptogram will not be a perfect square or 1 less than a perfect square. 

10 2 Detailed instructions for the construction of revolving grilles will be found in Special Text No. 166, Ad- 
vanced Military Cryptography, sec. V. 




( 85 ) 



REF ID : A59439 





apertures concerned will disclose two cells which will also be occupied by a plain-text digraph, 
but the letters composing the digraph will be in reverse order in the plain text. This property is true 
also of two successive apertures in position 2 when they turn up in position 4. Let the student 
verify this by means of the grille which he has constructed. Thus, referring to figure 43, at A 
is shown the grille in position 1. In the first row are shown 2 apertures, at coordinates 1—4 and 
1-8. At B are shown the results of the first application of the grille to the grid. Note the letters 
Y 0 (first 2 letters of message) in cells 4 and 8. Now note that the symmetrically-corresponding 
cells disclosed when the grille is in position 3 are cells 57 and 61 and these correspond to cells 4 
and 8 in the reverse order. The letter T in cell 57 therefore symmetrically corresponds with 
letter 0 in cell 8; the letter Y in cell 61 corresponds with letter Y in cell 4. The same is true of all 
other letters in positions 1 and 3. Asa consequence of this property of grilles, a single cryptogram 
can be handled as though it were really two cryptograms of identical length having certain 
characteristics by means of which an assumption made in one text may be verified by what it 
yields in the other text. That is, when the cryptogram is transcribed as a series of letters in one 
line and the same text is written in another line under these letters but in reversed order, then the 
superimposed letters will bear the symmetrical relationship pointed out in this paragraph. If 
two letters in the upper line of such a transcription are taken to form a digraph, the two corre- 
sponding letters in the lower line must form a digraph but in reversed order in the plain text. 
For example, if the cry p togram of figure 43 is written out as explained above, the result is as 
shown at figure 44. Now the presence of the Q in position 39 suggests that it be combined with 

1 2 3 4 5 0 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 

OOMYUCHOMUELARNLFHAIRLNERIDNPGEO 

SETYYBCTUSSIOERHTTUOTUCSEQEEHTST 

33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 

TSTHEEQESCUTOUTTHREOISSUTCBYYTES 

OEGPNDIRENLRIAHFLNRALEUMOHCUYMOO 

Figure 44. 

a U. If the U in position 43 is taken, then the symmetrical digraph corresponding to Q U would 
be L I; if the U in position 56 is taken, the symmetrically-corresponding digraph would be M I. 
Furthermore, two apertures which are in the same column and which do not have an intervening 
aperture between them, will yield a good digraph in all 4 positions of the grille. For example, note 
apertures 2-6 and 3-6 at A in figure 43. When the grille is turned to positions 2, 3, and 4 they will 
disclose two sequent letters in each case. An analysis of the symmetries produced by an 8X8 
grille yields the following table, which shows what cells are disclosed in the other 3 positions when 
an aperture is cut in any one cell in 1 of the 4 positions of the grille. For example, an aperture 
cut in cell 1 1 (position 1) will disclose grid-cell 23 when the grille takes position 2, grid-cell 54 when 
the grille takes position 3, and grid-cell 42 when the grille takes position 4. 
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The second principle may be termed that of exclusion. On account of the system upon which 
the construction of a revolving grille is based, a knowledge of the location of an aperture in one 
of the bands brings with it a knowledge of 3 other locations in which there can be no apertures. 
For example, referring to A in figure 43, the presence of the aperture at coordinates 1-4 precludes 
the presence of apertures at coordinates 4-8, 8-5, and 5-1. By virtue of this principle of exclu- 
sion, the number of possibilities for choice of letters in solving a cryptogram prepared by means 
of a revolving grille becomes much reduced and the problem is correspondingly simplified, as 
will be seen presently. 

j. The third principle may be termed that of sequence. When trying to build up text, the 
letters which follow a given sequence of plain-text letters will usually be found to the right and 
below, that is, if the normal method of writing was used (left to right and from the top down- 
ward). For example, referring to figure 44, if the trigraph Q U E is to be built up, neither the U 
in position 5 nor the U in position 10 is very likely to be the one that follows the Q; the U in position 
43 is the most likely candidate because it is the first one beyond the Q. Suppose the U in position 
43 is selected. Then the E for Q U E cannot be the one in position 40, or in any position in front 
of 40, since the E must be beyond the U in the diagram. 

g. In solving a grille, it will be found advisable to prepare a piece of cross-section paper of 
proper size for the grille and to cut each aperture as soon as its location in the grille becomes 
quite definite. In this way not only will the problem be simplified but also when completed the 
proper grille is at hand. 

32. Solution of example. — a. Suppose the cryptogram shown in figure 43 is to be solved. It 
has 64 letters, suggesting a grille 8X8. The cryptogram is first transcribed into a square 8X8, 
yielding what has already been obtained at Fin figure 43. The Q in position 39 suggests that it 
is part of a word inscribed when the grille was in position 3, since there will be 16 plain-text letters 
inscribed at each position of the grille. Then a piece of cross-section paper is prepared for 
making the grille as shown in figure 45-A, and an aperture is cut in the proper position to dis- 
close, in position 3, cell 39. It will be found that this is the aperture located at coordinates 4-2 
of the grille shown in figure 45-A. At the same time the other 3 cells numbered 4 in the second 
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Figure 45-A. 



Figure 45-B. 



band of the grille are marked so that they cannot become apertures. The result is shown in 
figure 45-B. Conforming to the principle of sequence, the U to be combined with the Q is 
sought to the right of the Q in figure 43-F. There are three candidates, in positions 43, 46, and 
56. They yield: 
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(Grille in position 3) 

39 43 39 46 39 56 

Q U Q U Q U 

I L(=L I p ) I A(=A I p ) I M(=M Ip) 

All of the symmetrical correspondents of these 3 Q U’s are good digraphs and it is impossible to 
eliminate any of the three possibilities. The U in position 43 would place an aperture at coordi- 
nates 6-3 in figure 45-B ; the U in position 46 would place an aperture at coordinates 6-6 ; and the 
U in position 56 would place an aperture at coordinates 7-8. All of these are possible, none being 
excluded by principle 2. Suppose the Q U is followed by E. There are only two possibilities: 
an E in cell 51 and E in cell 63. The following possibilities are presented: 
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None of the symmetrical correspondents of the Q U E’s are impossible sequences in plain text, 
although 0 A I is not as probable as the others. (The 0 could be the end of a word, the AI 
the beginning of the word AID, AIM, AIR, etc.) Each of these possibilities would be tested by 
principle 2 to see if any conflicts would arise as to the positions of apertures. As in all cases of 
transposition ciphers, the most difficult part of the solution is that of forcing an entering wedge 
into the structure and getting a good start; when this has been done the rest is easy. Note what 
the results are when the proper apertures are assumed for QUEST in this case, as shown in figure 
45-C. In position 1 this yields OUR LI . . .; in position 2 it yields two digraphs AN and UT; 
in position 4 it yields two digraphs H A and R 0. The student should note that the indicated 
digraphs A N and R 0 in positions 2 and 4, respectively, are certain despite the fact that there is 
a space between the two apertures disclosing these letters, for the principle of exclusion has per- 
mitted the crossing off of this cell as a possibility for an aperture. 
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Figure 45-C. 
(Grille in position 3) 



6. Enough has been shown of the procedure to make further demonstration unnecessary. 
Given the sequence OUR LI one begins to build on that, assuming a word such as LINE. This 
yields possibilities for the placement of additional apertures in the grille; these are tested in 
positions 2, 3, 4, and so on. When any 16 consecutive letters of plain text have been established 
all apertures have been ascertained and the problem has been completed. Subsequent crypto- 
grams prepared by the same grille can be read at once. 
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c. If attempts at solution on the basis of the alpha method of using a grille have failed, the 
obvious modifications in procedure on the basis of the beta method can readily be made. 

33 . Concluding remarks on the solution of revolving grilles. — a. There is nothing about the 
mechanics of revolving grilles which prevents their employment in enciphering complete words 
instead of individual letters. However, the assembling of whole words in intelligible sequences 
and thus the reconstruction of the original plain text is a much easier matter than assembling 
single letters to form the words of the original plain text 

b. In case the same grille has been employed several times with separate grids to encipher a 
message that is considerably longer than a single grid will accommodate (see footnote 2, par. 316), 
the several sections each representing the set of letters enciphered on one grid may be super- 
imposed and the general solution described in paragraph 26 may then be applied. 

c. In case the capacity of a grille is in excess of the number required by the length of the 
text to be enciphered, either of two procedures may be agreed upon. The grid cells which would 
otherwise be unoccupied may be filled by nulls, or the grid may be left incomplete. As regards 
the former procedure, little more need be said than that the presence of a few nulls will only 
delay solution a bit until the fact that nulls are being employed for this purpose becomes estab- 
lished. But the second type of procedure calls for more comment. If the grid is to be left 
incomplete it is necessary, before applying the grille, to count the number of plain-text letters 
and to cancel from the grid a number of cells equal to the number of cells in excess of the 
total number required. The position of the cells to be cancelled must be agreed upon: commonly, 
they are those at the end of the grid. Such cells are marked so that when they become exposed 
during the rotations of the grille they will not be used. Thus, for example, the grille shown in 
figure 43-A is intended for a grid of 64 letters; if the message to be enciphered contains only 53 
letters, 12 cells of the grid must be canceled, and by agreement they may be cells 53 to 64, inclusive. 
The solution of a single cryptogram of this sort, or even of several of them of different lengths, 
may become a rather difficult matter. First of all, clues as to the dimensions of the grille are no 
longer afforded by the total number of letters in the cryptogram, so that this information can 
be obtained only by more or less laborious experimentation. Grilles of various dimensions must 
be assumed, one after the other, until the correct dimensions have been found. In the second 
place, the symmetrical relationships pointed out in paragraph 31 no longer obtain, so that a 
single cryptogram cannot be handled as though it were constituted of two messages of identical 
length. Of course, in trying out any assumed dimensions, the 64 letters of the cryptogram may 
be written out in two superimposed lines, blanks being left for those positions which are unfilled. 
The procedure then follows the normal lines. About the most hopeful clues would be obtained 
from a knowledge of the circumstances surrounding the transmission and affording a basis for 
the assumption of probable words. However, were such a system employed for regular com- 
munication there would undoubtedly be cases of cryptograms of identical lengths, so that the 
type of solution given in paragraph 26 will be applicable. Once a solution of this sort has been 
obtained, the dimensions of the grille may be ascertained. Subsequent cryptograms may then 
be attacked on the basis of the normal procedure, with such modifications as are indicated by 
the absence of the number of letters needed to make a completely-filled grid. 

34 . Indefinite or continuous grilles. — a. In his Manual of Cryptography, Sacco illustrates 
a type of grille which he has devised and which has elements of practical importance. An ex- 
ample of such a grille is shown in figure 46. This grille contains 20 columns of cells, and each 
column contains 5 apertures distributed at random in the column. There are therefore 100 
apertures in all, and this is the maximum number of letters which may be enciphered in one posi- 
tion of the grille. The plain text is inscribed vertically, from left to right, using only as many 
columns as may be necessary to inscribe the complete message. A 25-letter message would require 
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but 5 columns. To form the cryptogram the letters are transcribed horizontally from the rows, 
taking the letters from left to right as they appear in the apertures. If the total number of 
letters is not a multiple of 5, sufficient nulls are added to make it so. In decryptographing, the 
total number of letters is divided by 5, this giving the number of columns employed. The cipher 
text is inscribed from left to right and top downwards in the apertures in the rows of the indicated 
number of columns and the plain text then reappears in the apertures in the columns, reading 
downward and from left to right. (It is, of course, not essential that nulls be added in encipher- 
ment to make the length of the cryptogram an exact multiple of 5, for the matter can readily 
be handled even if this is not done. In decipherment the total number of letters divided by 5 




Figure 46. 



will give the number of complete columns; the remainder left over from the division will give 
the number of cells occupied by letters in the last column on the right.) 

b. Such a grille can assume 4 positions, two obverse and two reverse. Arrangements must 
be made in advance as to the sequence in which the various positions will be employed. 

c. The solution of a single cryptogram enciphered by one and only one position of such a 
grille presents a practically hopeless problem, for the apertures being distributed at random 
throughout the grille there is nothing which may be seized upon as a guide to the reconstruction 
of either the grille or the plain text. It is conceivable, of course, that a person with an infinite 
amount of patience could produce an intelligible text and a grille conformable to that text, the 
grille having a definite number of columns and a fixed number of apertures distributed at random 
throughout the columns. But there would be no way of proving that the plain text so obtained 
is the actual plain text that was enciphered; for it would be possible to produce several “solutions” 

I of the same character, any one of which might be correct. 4 

t d. However, suppose a grille of this sort were employed to encipher a long message, requiring 

two or more applications of the grille. For example, in the case of the grille shown in figure 46, 
having a capacity of 100 letters per application, suppose a message of 400 letters were to be 
enciphered, requiring two obverse and two reverse applications of the grille. It is obvious that 

: symmetrical relationships of the nature of those pointed out in paragraph 31 can be established. 

' Of course, if the grille is used several times in the same position to its full capacity, producing 

cryptograms of multiples of 100 letters, then the sections of 100 letters may be superimposed and 
the general solution elucidated in paragraph 26 applied. 

4 In this connection, see Military Cryptanalysis, Part III, sec. XI, footnote 8. 





e. If the grille shown in figure 46 were used to encipher two messages, one of 80 letters, the 
other of 85, it would be possible to solve these messages. For by eliminating 5 letters from the 1 

longer message, the two cryptograms can be superimposed and handled as in paragraph 26. The 
difficulty would be in finding the 5 extra letters. Of course, if it should happen that one of the 
messages required 3 or 4 nulls and letters such as J, X, or Z were employed for this purpose, the 
nulls would be likely characters for elimination. But regardless of this, even if letters of medium 
or high frequency were used as nulls, patient experimentation would ultimately lead to solution. 

The latter, it must be conceded, would be difficult but not impossible. 
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Section VIII 

COMBINED SUBSTITUTION-TRANSPOSITION SYSTEMS 

Paragraph 



Reasons for combining transposition with substitution 35 

Other types of combined substitution-transposition systems 36 



35. Reasons for combining transposition with substitution. — a. Transposition methods are, 
from the cryptographic point of view, rather highly regarded because they are, as “hand methods” 
go, rather rapid in operation and usually quite simple. However, from their very nature they 
entail the disadvantage that a single-letter omission or addition may render their decryptograph- 
ing difficult if not impossible for the average cryptographic clerk. But from the standpoint of 
modem cryptography the principal disadvantage of transposition methods is that they can be 
mechanized only with great difficulty — certainly with greater difficulty than is the case of sub- 
stitution methods. Only one or two attempts have been made to produce machinery for effecting 
transposition, and these have not been successful. 

b. Pure transposition, that is, transposition by itself, without an accompanying substitution 
or other means of disguise for the letters of the plain text, hardly affords sufficient guarantees for 
cryptographic security in the case of a voluminous correspondence which must be kept really 
secret for any length of time. For no matter how complex the method, or how many trans- 
positions may be applied to the letters of a single message, sight must never be lost of the fact 
that when there are many messages in the same key there are bound to he two or more of identical 
length; and when this is the case the type of solution described in paragraph 26 may be applied 
to these cryptograms, the transposition keys recovered, and then all other messages in the same 
key translated. 

c. A message may undergo monoalphabetic substitution and the resulting text passed through 
a simple transposition. When this is the case a uniliteral frequency distribution will, of course, 
exhibit all the characteristics of monoalphabeticity, yet the cryptogram will resist all attempts 
at solution according to straightforward simple substitution principles. It is usually not difficult 
to detect that a transposition is involved because there will not only be long strings of low- 
frequency letters or high-frequency letters but what is more important, there will be very few or 
no repetitions of digraphs, irigraphs, and tetragraphs, since these will be broken up by the trans- 
position. When a uniliteral distribution presents all the external evidences of monoalphabeticity 
and yet there are no repetitions, it is almost a positive indication of the presence of transposition 
superimposed upon the substitution, or vice versa. (The former is usually the case.) 

d. When confronted with such a situation the cryptanalyst usually proceeds by stages, 
first eliminating the transposition and then solving the substitution. It is of course obvious 
that the general solution for transposition ciphers (cryptograms of identical length in the same 
key) will not be applicable here, for the reason that such a solution is based upon anagramming, 
which in turn is guided by the disclosure of good digraphs, trigraphs, and polygraphs. Since the 
letters of a combined substitution-transposition cipher are no longer the same as the original 
plain-text letters, simple anagramming of columns formed by superimposing identical-length 
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cryptograms can yield no results, because there is nothing of the nature of plain text to guide the 
cryptanalyst in his juxtaposition of columns. 1 

e. Of course, if it should happen that the substitution process involves known alphabets, 
the cryptanalyst can remove the effects of the substitutive process before proceeding to elim- 
inate the transposition, even if in the encipherment the substitution came first. For example, if 
a standard cipher alphabet were employed for the substitution the uniliteral frequency distri- 
bution would give indications thereof and the cipher letters could immediately be converted 
to the normal plain-text equivalents. The latter may then be studied as though merely trans- 
position had been applied. But if unknown mixed cipher alphabets were employed, this initial 
step can not be accomplished and a solution must usually wait upon the removal of the trans- 
position before the substitution can be attacked. The latter may be very difficult or impossible 
where a good transposition method is used; where simple columnar transposition is used the 
removal of the transposition can be effected if the message is long enough. 

f. Of course if nothing is known about the system of transposition that has been employed, 
there is hardly anything to do but experiment with various types of transposition in an attempt 
to bring about such an arrangement of the text as will show repetitions. If this can be done, 
then the problem can be solved. For example, suppose that a message has been enciphered by a 
single mixed cipher alphabet and the substitution text has then been inscribed within a rectangle 
of certain dimensions according to one of the usual routes mentioned in paragraph 5 of this text. 
Repetitions in the plain text will of couise be preserved in the substitution text but will be 
destroyed after the transposition has been applied. The cryptanalyst, however, in his attempts 
to eliminate the transposition, may experiment with route transpositions of the various types, 
employing rectangles of various dimensions as suggested by the total number of letters in the 
cryptogram. If he perseveres, he will find one route which he will know is correct as soon as he 
tries it because it will disclose the repetitions in the plain text, although the latter are still covered 



j by a substitution. 

! g. Practically all the methods of transposition which may be applied to plain text may also 

be applied to a text resulting from an initial transformation by substitution. As already men- 
tioned, route transposition may be used; reversed and rail-fence writing, columnar transposition 
' with or without keying and with complete or incomplete rectangles are also possible. From a 

L practical standpoint, keyed-columnar transposition applied to a monoalphabetic substitution is 

not only a popular but also a fairly secure combination because in this case the elimination of the 
} transposition is a rather difficult matter. If the rectangle is completely filled the problem is not 

i insurmountable in the case of a long message transposed by means of transposition with a rec- 

tangle of fairly small dimensions. For by assuming rectangles of various dimensions suggested 
by the total number of letters, cutting the columns apart, and then combining columns on the 
basis of the number of repetitions produced within juxtaposed columns and between different 
sets of juxtaposed columns, it is possible to reconstruct the rectangle and thus remove the trans- 
position phase. This, however, is admittedly a slow and difficult process even under the most 
favorable conditions; and if the rectangle is incompletely filled the process is very difficult. For 
in the latter case the lack of absolutely clear-cut knowledge as to the lengths of the columns, the 
_ juxtaposition of columnar material becomes replete with uncertainties and engenders feelings 

’ of confusion, hopelessness, and inadequacy in the mind of the cryptanalyst. However, he need 

i It, should, however, not be inferred that anagramming processes are entirely excluded in the cryptanalysis 
of all combined substitution-transposition systems. In certain cases the anagramming process may be guided 
by considerations of frequency of letters or fragments of letters. A case of this kind will be encountered in the 
solution of the ADFGVX cipher, par. 40. 
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not be wholly in despair if he is confronted with a problem of this nature in war time, when 
many cryptograms become available for study. For there are special methods of solution suitable 
to the occasion, created by special circumstances attendant upon the interception of a voluminous 
traffic. In subsequent paragraphs the student will come to understand what is here meant by 
the special circumstances and will learn of these special solutions. 

36. Other types of combined substitution-transposition systems. — a. There is no technical 
obstacle to the application of a transposition to the text resulting from any type of substitution, 
even if the latter is polyalphabetic or polygraphic in nature. The obstacles, or rather objections, 
to such combinations are practical in their character — they are too complex for ordinary use and 
the prevalence of errors makes them too difficult to handle, as a general rule. However, they 
have been and are sometimes used even as field ciphers. For instance, on the southeastern front 
during the World War, the Central Powers made use of a somewhat irregular polyalphabetic sub- 
stitution involving four standard alphabets and a keyed columnar transposition with incom- 
pletely-filled rectangles of a relatively large number of columns. Nevertheless, messages in this 
system were solved by taking advantage of the possibility of devising special solutions. 

b. A few remarks may be made in regard to the order in which the two processes, sub- 
stitution and transposition, are employed in a combined system. It is clear that when the 
substitution is monoalphabetic it is immaterial, so far as cryptographic security is concerned, 
whether substitution is followed by transposition or vice versa, because the equivalent of each 
plain-text letter remains fixed regardless of the order in which the plain-text letters appear in 
the plain text. However, if the substitution is polyalphabetic in character it is better that the 
transposition process precede the substitution process, and that the number of alphabets em- 
ployed be different from tbe number of elements in the transposition key, if columnar trans- 
position is the case. The best situation, from a cryptographic security standpoint, is when 
the two key lengths (substitution and transposition) have no common factor. If the two keys 
are of the same length, the letters in each column are enciphered by the same cipher alphabet 
and thus the cryptogram would contain a certain number of sections of approximately equal 
length, composed of letters falling in the same cipher alphabet. 

c. Digraphic substitution, such as that produced by the Playfair Cipher, may be combined 
with transposition to yield cryptograms of fair security. But here again the elimination of the 
transposition phase by taking advantage of special circumstances or by rearranging the next so 
as to uncover the repetitions which are inevitable in the Playfair Cipher, will result in solution. 

d. A particularly fruitful source of combined substitution-transposition is to be found in those 
methods generally designated as fractionating systems, in which in the substitution phase each 
plain-text letter is replaced by an equivalent composed of two or more components or “fractions” 
and then these components are subjected to transposition in a second phase. This latter may be 
followed by a third phase, recombination of distributed components, and a fourth phase, the 
replacement of the recombined components by letters. Thus, such a system comprises a first 
substitution, a transposition, a recombination, and a second substitution . 2 In the subsequent 
paragraphs certain systems of this sort will be dealt with in detail. They are interesting examples 
of practical systems of cryptography which have been used in the field of military operations in 
the past and may again be used in the future. The first one to be discussed is particularly inter- 
esting for this reason alone; but it is also of interest because it will serve as a model for the student 
to follow in his study of methods for the solution of combined substitution-transposition ciphers 
in general. 




s See Special Text No. 166, Advanced Military Cryptography, sec. XI. 



Section IX 



SOLUTION OF THE ADFGVX SYSTEM 



Paragraph 

Introductory remarks - - 37 

Special solution by means of identical endings - 38 

Special solution by means of identical beginnings - 39 

Special solution by the exact factor method 40 

General solution for the ADFGVX system - 41 

Basic principles of the general solution _ 42 

Illustration of solution - 43 



37. Introductory remarks. — a. One of the most interesting and practical of the many 
methods in which substitution and transposition are combined within a single system is that 
known in the literature as the ADFGVX cipher. 1 In this system a 36-character bipartite substitu- 
tion checkerboard is employed, in the cells of which the 26 letters of the alphabet and the 10 
digits are distributed in mixed order, often according to some key word. The row and column 
indicators (coordinates) are the letters ADFGVX, and, taken in pairs, the latter are used as substi- 
tutes for tbe letters of the plain text. These substitutive pairs are then inscribed within a rec- 
tangle and a columnar transposition takes place, according to a numerical key. The cipher text 
consists then merely of the 6 letters A, D, F, G, V, and X. 

b. The ADFGVX cipher system was inaugurated on the Western Front by the German Army 
on March 1, 1918, for communication between higher headquarters, principally between head- 
quarters of divisions and corps. When first instituted on March 1, 1918, the checkerboard con- 
sisted of 25 cells, for a 25-letter German alphabet (J was omitted), and the 5 letters A, D, F, G, and 
X used as coordinates. On June 1 the letter V was added, the checkerboard having been enlarged 
to 36 cells, to take care of a 26-letter alphabet plus the 10 digits. Transposition keys ranged from 
15 to 22 numbers, inclusive, and both the checkerboard and the transposition key were changed 
daily. The number of messages in this system varied from 25 a day upon the inception of the 
system to as many as 150 per day, during the last days of May 1918. The first solution was made 
on April 6 by the French. The cipher continued in use rather extensively until late in June but 
from that time until the Armistice the volume of messages diminished very considerably. 
Although only 10 keys, covering a period of as many days were ever solved, the proportion of 
solved messages in the whole intercepted traffic was about 50 percent. This was true because of 
the fact that the keys solved were those for days on which the greatest number of messages was 
intercepted. The same system was employed on the southeastern front from July 1918 to the 
end of the war. Keys were in effect at first for a period of 2 days and beginning on September 1, 
for a period of 3 days. In all 17 keys, covering a total of 44 days, were solved. 

c. At the time that the Allied cryptanalytic offices were working with cryptograms in this 
system only three methods were known for their solution and all three of them are classifiable 
under the heading of special solutions, because certain conditions had to obtain before they 
could be applied. No general solution had been developed until after hostilities had ceased . 2 

1 Special Text No. 166, Advanced Military Cryptography, sec. XL 

2 The general solution to be described in paragraphs 41-43 was not established until after the Armistice. 
Had it been elaborated earlier there would no doubt have been many more solutions than were actually effected 
by the methods then available. 
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Because they are interesting and useful some attention will be devoted to both the general and the 
special solutions. Since the special solutions are easy to understand and serve as a good introduc- 
tion to the general solution, they will be taken up first. 

38. Special solution by means of identical endings. — a. In paragraph 24 it was demonstrated 
how the solution of keyed-columnar transposition ciphers can be facilitated and simplified by the 
comparison of two cryptograms which are in the same key and the plain-text endings of which 
are identical. It was noted in that case that a study of the irregularly distributed cipher-text 
identities between the two cryptograms permits of not only cutting up the text into sections 
that correspond with the long and the short columns of the transposition rectangle but also of 
establishing the transposition key in a direct manner almost entirely mathematical in nature. 
When this has been accomplished the plain texts of these two messages are at once disclosed, and 
all other messages in the same key may be read by means of the key so reconstructed. 

b. The same method of solution is applicable to the similar situation, if it can be found, in 
the case of the ADFGVX system, except that one more step intervenes between the reconstruction 
of the transposition rectangle end the appearance of the plain text in the rectangle: A mono- 
alphabetic substitution must be solved, since the text in the rows of the rectangle does not 
consist of plain-text letters but of pairs of components representing these letters as enciphered by 
means of a bipartite substitution alphabet. Moreover, this latter step is comparatively simple 
when there is a sufficient amount of text in the two rectangles; if not, additional material for use 
in solving the monoalphabet can be obtained from other cryptograms in the same key, if they are 
available, since the transposition key, having already been reconstructed from the two crypto- 
grams with identical endings, will permit of inscribing all other cryptograms in the same key 
within their proper rectangles. 

c. A demonstration of the application of the principles involved in such a solution will be 
useful. The following cryptograms have been intercepted on the same date, the 20th: 



No. 1 



To CG 22d Brigade: 

5 



10 



15 



20 



X V A A X VDDAG DADVF ADADA FXGFV XFAXA 



35 



45 



60 



65 



60 



XVAVF A V X A D GFFXF FGAGF DGDGD DGAFD 



65 



70 



75 



SO 



85 



00 



AADDD XDAVG GAADX ADFVF FDFXF GFGAV 



95 



100 



106 



110 



115 



120 



AFAFX FFXFX FVDVX AFFGX A A A V A VAFAG 



130 



140 



145 



160 



DDFAG VFADV FAVVX G V A A A FDFAX XFAAG 
D X 
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No. 2 

To CG 23d Brigade: 



F 


D 


F 


F 


5 

F 


F 


V 


F 


A 


10 

D 


D 


V 


F 


V 


15 

D 


G 


A 


F 


D 


20 

F 


D 


A 


G 


A 


25 

D 


F 


D 


F 


30 

A F 


V 


A 


X 


G 


35 

D 


V 


X 


G 


F 


40 

X 


V 


X 


D 


X 


45 

V 


A 


A 


A 


A 


50 

D 


G 


X 


F 


F 


55 

D 


V 


F 


A 


60 
A G 


V 


G 


V 


F 


65 

F 


F 


D 


A 


F 


70 

F 


F 


X 


D 


A 


75 

F 


X 


G 


A 


F 


80 

D 


V 


F 


V 


X 


85 

V 


D 


D 


F 


90 

A D 


D 


A 


A 


A 


95 

X 


A 


A 


F 


F 


100 

A 


F 


V 


F 


X 


105 

F 


F 


A 


X 


X 


110 

A 


A 


D 


V 


X 


115 

A 


V 


D 


A 


120 
V F 


D 


F 


A 


V 


125 

X 


V 


A 


D 


X 


130 

F 


A 


X 


F 


F 


135 

X 


X 


A 


A 


V 


140 

X 


X 


A 


D 


X 


145 

A 


A 


A 


V 


150 

V G 


A 


G 


D 


X 


155 

X 


F 


D 


F 


A 


160 

X 


F 


D 


G 


D 


165 

F 


F 


X 


D 


G 


170 

X 


F 


A 


G 


D 


175 

F 


F 


D 


D 


180 

V D 


D 


X 


D 


A 


185 

F 


A 


G 


X 


X 


190 

A 


F 


G 


A 


V 




























*. 





d. The delimitation and marking of identities between these two cryptograms is a procedure 
similar to that explained in paragraph 246, except that a little more study may be necessary in 
this case because occasionally there may be considerable uncertainty as to exactly where an 
identity begins or ends. The reason for this is not difficult to understand. Whereas in para- 
graph 246 the process involves “unfractionated” letters and there are about 18 or 20 different 
letters to deal with, so that an “accidental identity” is a rather rare occurrence, in the present 
problem the process involves fractions of letters (the components of the bipartite cipher equiva- 
lents), and there are only 6 different characters to deal with, so that such “accidental identities” 
are quite frequent. Now the cryptanalyst is not able at first to distinguish between these acci- 
dental identities and actual identities and this is what makes the process somewhat difficult. 
What is meant will become perfectly clear presently. 

e. Taking, the two illustrative cryptograms, the first step is to ascertain what identities 
can be found between them, and then mark off these identities. For example, it is obvious that 
if the messages end alike the last several letters in No. 1 should be found somewhere in No. 2, 
and likewise the last several letters in No. 2 should be found somewhere in No. 1. The number 
of letters in identical sequences will depend upon the length of the identical text and the width 
of the transposition rectangle. Searching through No. 2 for a sequence such as A G D X, or 
G D X, or at least D X, the tetragraph A G D X is found as letters 151-54. The last column of No. 2 
ends with F G A V; searching through No. 1 for a sequence F G A V, or G A V, or at least A V, the 
tetragraph F G A V is found as letters 87-90. These identities are underlined or marked off in 
some fashion, and search is made for other identities. It would be a great help if the width of 
the transposition rectangle were known, for then it would be possible to cut up the text into 
lengths approximately corresponding to column lengths, and this would then restrict the search 
for identical sequences to those sections which correspond to the bottoms of the columns. Sup- 
pose the key to contain 20 numbers. Then the rectangle for No. 1, containing 152 letters, 
would consist of 12 long columns of 8 letters and 8 short ones of 7 letters; that for No. 2, con- 
taining 194 letters, would consist of 14 long columns of 10 letters and 6 short ones of 9 letters. 
If that were correct then in No. 1 the end of the first column would be either X V D D, or X V D. 
Searching through No. 2 for either of these a sequence X V D D is found as letters 84-7. Column 
1 is probably a long column in No. 1. The word probably is used because the identity may 
extend only over the letters X V D, and the next D may be an accidental similarity, since the chances 
that D will appear by pure accident are 1 in 6, which is not at all improbable. It must also be 
pointed out that a certain number of telegraphic errors may be expected, and since there are 



XMv, 



only 6 different letters the chances that an F, for example, will be received or recorded as a D 
are fairly good. Column 1 of No. 2 ends either with V F A D or V F A. Searching through No. 1, 
a sequence V F A D is found as letters 14-17 ; a sequence V F A is found as letters 34-6; a sequence 

V F F D is found as letters 79-82; a sequence V F A D is also found as letters 126-130; a sequence 

V F A is found as letters 130-2. Here are several possibilities; which is the one to choose? Two 
of these possibilities coincide exactly with the full sequence being sought, V F A D. Can one of 
them be eliminated as a possibility? Perhaps tables to facilitate the location of possible “breaks” 
will be helpful in making the elimination (see paragraph 16m). “Break tables” are therefore ' 
constructed for the messages on the basis of rectangles of 20 columns, and are as shown below. 





.0 


8 


16 


24 


32 


40 


48 


56 


64 


72 


80 


88 


96 


0 


0 


8 


16 


24 


32 


40 


48 


56 


64 


72 


80 


88 


96 


7 


7 


15 


23 


31 


39 


47 


55 


63 


71 


79 


87 


95 


103 


14 


14 


22 


30 


38 


46 


54 


62 


70 


78 


86 


94 


102 


110 


21 


21 


29 


37 


45 


53 


61 


69 


77 


85 


93 


101 


109 


117 


28 


28 


36 


44 


52 


60 


68 


76 


84 


92 


100 


108 


116 


124 


35 


35 


43 


51 


59 


67 


75 


83 


91 


99 


107 


115 


123 


131 


42 


42 


50 


58 


66 


74 


82 


90 


98 


106 


114 


122 


130 


138 


49 


49 


57 


65 


73 


81 


89 


97 


105 


113 


121 


129 


137 


145 


56 


56 


64 


72 


80 


88 


96 


104 


112 


120 


128 


136 


144 


152 



‘Break” table for No. 1 (152 letters) 
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10 


20 


30 


40 


50 


60 


70 


80 


90 


100 


110 


120 


130 


140 


r o 


10 


20 


30 


40 


50 


60 


70 


80 


90 


100 


no 


120 


130 


140 



9 9 19 29 39 49 59 



109 119 129 139 149 



18 18 28 38 48 58 68 78 88 98 108 118 128 138 148 158 

27 27 37 47 57 67 77 87 97 107 117 127 137 147 157 167 

36 36 46 56 66 76 86 96 106 116 126 136 146 156 166 176 

45 45 55 65 75 85 95 105 115 125 135 145 155 165 175 185 

54 54 64 74 84 94 104 114 124 134 144 154 164 174 184 194 

“Break” table for No. 2 (194 letters) 
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From these tables it follows that as regards message No. 1 there can be a break after the 7th, 8th, 
14th, 15th, 16th . . . letters but not after the 6th letter, nor after the 9th to 14th letters, nor 
after the 17th to 21st letters, and so on; as regards message No. 2 there can be a break after the 
9th, 10th, 18th, 19th, 20th, . . . letters but not after the 8th letter nor after the 11th to 18th 
letters, nor after the 21st to 27th letters, and so on. Referring again to the two VFAD sequences 
in No. 1 which may correspond with the VFAD sequence in No. 2, it was found that the first 
candidate would require a break immediately after the 17th letter. But the break table for No. 1 
precludes this possibility; hence the first VFAD sequence in No. 1 in position 14-17 may be elimi- 
nated as a candidate, leaving the second VFAD, in position 126-130, as a candidate. This would 
require a break after the 130th letter and reference to the break table for No. 1 shows this to be a 
possibility. Hence, the VFAD in position 126-130 in No. 1 will tentatively be accepted as 
matching the VFAD sequence in No. 2. Another section of the text of one or the other crypto- 
gram is next selected, with a view to establishing additional identities. To go through the 
whole process here would consume too much space and time. Moreover, it is not necessary, 
for the only purpose in carrying the demonstration this far is to indicate to the student the 
general procedure and to show him some of the difficulties he will encounter in the identifica- 
tion of the similar portions when the text is composed of only a very limited number of different 
letters. In this case, after more or less tedious experimentation, the hypothesis of a key of 20 
columns is established as correct, whereupon two sets of 20 identities are uncovered and the 
identities are found to be as shown below. 



No. 1 
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V 
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A 
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x_ 
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10 
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15 

V F 
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20 
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25 

V 
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30 

X A 
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45 

X F 
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50 
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D 
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55 
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60 
F D 
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65 
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70 

G 
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75 

D X 
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80 
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_D 
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86 
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F_ 
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90 

A V 
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10 












11 
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96 

x_ 
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100 
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105 

V X 


_A 
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115 
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A G 
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14 
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V X 
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F 


A 


145 
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150 

A G 
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Figure 47. 
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No. 2 
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D 


F 


F 


5 
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_F 
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10 

JD 
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15 
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20 
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A 


25 
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D F 
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30 

F 
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3 
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G 


35 

D 


V_ 


X 


_G 


F 


40 

X 


V 


X 
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X 


45 

V 


A 


A 
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A 


50 

D 


G 


X 


F 


F 


55 

D 


V 


F A 


A 


60 

G 














4 




















5 


















6 








V 


G 


V 


F 


65 

F 


F 


D 


A 


F 


70 

F 


F 


X 


D 


A 


75 

F 


X 


G 


A 


F 


80 

D 


V 


F 


V 


X 


85 

V 


D 


D F 


A 


00 

D 



7 8 9 



120 

V D A V F 



160 

A A V V G 



180 

F D D V D 



17 18 19 20 
1 4 3 16 

Since the rectangle for No. 2 has 2 more letters in the last row than the rectangle for No. 1, 
two chains of equivalents at two intervals are constructed. Thus: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

1 9 19 3 8 2 6 11 7 17 

4 10 15 5 13 14 12 20 16 18 

These chains must now be united into a single chain by proper interlocking. Since cryptogram 
No. 1 has 12 long columns, and since the identities of these 12 columns are now known (1, 3, 
5, 7, 9, 12, 13, 14, 16, 17, 19, 20), the interlocking of the two chains and hence the transposition 
key must be this: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

7 5 17 13 1 14 9 12 19 20 3 16 8 18 2 4 6 10 11 . 15 

g. The two cryptograms may now be transcribed into their proper transposition matrices, 

as shown in figure 48. 

* It is necessary to remark that in setting up the table of equivalencies, after determining the width of the 
rectangle, that message which has the lesser number of long columns is used as the basis for the normal sequence 

1. 2, 3 If the one having the greater number of long columns is employed as the base, the reconstructed 

key will be reversed. 



HO 1UU 

D A A A X AAFFA 

10 

125 130 

DFAVX VADXF 



13 

155 

A GJD X X 
16 

185 

D X D A F 
19 



180 

F D F A X 



iso 

A G X X A 



F A X X A 



HO 



170 

F X D G X 



135 

A XFFX 
14 

165 

F D G D F 
17 

F G A V 
20 

Figure 47— Continued 



140 145 

X A A V X X A D X A 

15 

176 

F A G D F 
18 



f. A table of equivalencies 3 is then drawn up: 

No. 1 1 2 3 4 5 6 ' 7 8 9 10 11 12 

No. 2 9 6 8 10 13 11 17 2 19 15 7 20 



13 

14 



14 

12 



15 16 

5 18 
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No. l 

7 I 17 13 1 14 1 li n 88 1 n 8 18 i 4 6 10 11 15 
FXDAXFAFVXAVGVAFAVAF 
GVFFVXAXAXDADFGVDGDF 
AAAAAFDFAFAVDADXGGFG 
GVGFAVDGAADAGVAFFAVX 
FFVXXDDFFAAFAVDAFAFA 
DAFFVVXGDGFAFXVXXDFA 
GVAFDXDAFDXGDGFAFXDA 
DXDXDAAVAXGD 



No. 2 

7 g 17 13 1 14 fl 12 19 20 3 16 8 18 1 4 8 10 11 15 

AFXVFVAFFFFAAFDFAFAX 

AXFDDAFAFADAFFVVDAFA 

GVDAFDDXDGAAFXFAGDFA 

VXFVFXVXDXGVFDVXXDAV 

GDAFFFFAVXAVXGDGFAFX 

VXXDFAVADADGDXGDFAVX 

FVFFVXXDDFFAAFAVDAFA 

FADAFFVVXGDG.FAFXVXXD 

FAGVAFDXDAFDXGDGFAFX 

DADXDXDAAVAXGD 



Fiqubk 48. 

h. A frequency distribution is now made of all the bipartite pairs, so as to solve the encipher- 
ing checkerboard. There is no necessity for going through this part of the solution, for it falls 
along quite normal lines of monoalphabetic substitution. The two plain-text rectangles are 
shown in figure 49. The checkerboard 4 is found to be as shown in figure 50a. 
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Figure 49. 



* Since the second cryptogram is addressed to the CG 23d Brigade and the first cryptogram mentions that 
the commander of that brigade has been ordered to do so and so, the solution of the groups GG (=2) and FG 
(*=3) is made by inference. This gives the placement of these two digits in the cipher square. 
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Figure 49— Continued. 
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Figure 60a. 



Figure 50c. 



Figure 506. 

i. Speculating upon the disposition of the letters within the enciphering checkerboard, it 
becomes evident that the key phrase upon which it is based is GERMAN MILITARY CIPHERS. 
The fact that the digit 2 follows B and the digit 3 follows C suggests that the digits are inserted 
immediately after the letters A, B, C, . . as they occur in the mixed sequence. Note the cells 
which still remain vacant after the key word mixed sequence is fully developed in the checker- 
board, and all the letters which do occur in the two messages are inserted in their correct cells 
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(fig. 506) . The complete checkerboard may therefore be taken almost certainly to be as shown 
in figure 50c. The date (20th) indicates that the transposition key will have 20 numbers in it. 
The transposition key was evidently derived from the first 20 letters of the mixed sequence: 

GERMANILTYCPHSBDFJKO 

7 5 17 13 1 14 9 12 19 20 3 16 8 18 2 4 6 10 11 15 

39. Special solution by means of identical beginnings. — a. In paragraph 23 was demon- 
strated the method of solution based upon finding two cryptograms which are in the same key 
and the plain texts of which begin with the same words. The application of this method to the 
corresponding situation in the case of the ADFGVX system should by this time be obvious. The 
finding of identical sequences is somewhat easier in this case than in the case of identical endings 
because the identities can be found in parallel progression from the beginning to the end of the 
two cryptograms being compared. Moreover, the discovery of two cryptograms with similar 
beginnings is easier than that of two with similar endings because in the former case the very 
first groups in the two cryptograms contain identities, whereas in the latter case the identities 
are hidden and scattered throughout the texts of the two cryptograms. On the other hand, the 
complete solution of a case of identical endings is very much more simple than that involving 
identical beginnings because in the former case the establishment of the identities carries with it 
almost automatically the complete reconstruction of the transposition key, whereas in the latter 
this is far from true and additional cryptograms may be essential in order to accomplish this 
sine qua non for the solution. 

b. The following represent 8 cryptograms of the same date, assumed to have been enciphered 
by the same key. 

No. 1 
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No. 4 






























A 


F 


G 


F 


X 


A 


G 


X 


A 


G 


X 


D 


D 


A 


F 


A 


A 


X 


A 


V 


G 


D 


D 


D 


D 


F 


A 


F 


G 


V 


D 


G 


D 


X 


A 


F 


D 


X 


A 


X 


G 


F 


G 


D 


D 


V 


A 


D 


X 


A 


X 


G 


F 


A 


X 


F 


D 


A 


D 


D 



G D 

No. 5 

XAAAD DGAAG DDDXF FAVGA XDGGD FFAVA 

D A A X A GDXDX XXXDG VFADA DFFFF VVGFD 

XFDGG DAXDG ADFD 



tiiflllilli 



Hi: iD; 






No. 6 



X D A A V 
G D F D A 
F D X A X 
G G F D D 
A D F F G 
D D D A V 
D X D V F 
X F D A G 
A F F A A 
V A X D A 



A G F G V 
D D A X X 
D V A X A 
D D A F F 
X D D V 



D X D G F 
A A G A X 
G A X F F 
D V F F V 
D G F D A 
G A V A D 
F X V A X 
A G A V D 
F F F D V 
G A D X D 



D D D D F 
A A D D F 
X F X D A 
V D G X A 



X V G D D 

D V F D F 

V D V A F 

V A G V A 

A F G A X 

F G D D F 

G F D A G 

V A G A F 

D F F A F 

V F A F F 



A V G X A 
D F F D D 
G V D V D 
X A A G G 
F F D V D 
F D G D V 
X F F F F 
D G D A V 
D A G D G 
F G D D A 



D X A A D 
F D D F X 
D D A G D 
X G X D D 
D D A G A 
D G G X A 
A A X D A 
V D D D D 
G A A A F 
D D D F A 



X G G A A 
F X X F D 
G G D A A 
D A D X F 
F A D A V 
X A X D A 
F V D X G 
D F X G V 
D X A X A 
G D F A X 



No. 7 



DDFXF DDGDF AXVDD VDVXA 
AGGFF AXDDG XDFAD DFDGD 
FXDDG FXGDV GFFGX DADFA 
ADXFX GVADA XGXAG AGDGV 

No. 8 



DFGFX DFAFF XDXAG ADGGG DDFGA XGVDF 

VVFDA AAXGD A V D V A DDGVD AFAG 

The cryptograms have been examined for identical beginnings, and Nos. 3 and 6 apparently 
begin alike, identical portions being underlined as shown in figure 51. Now the number of 
identical sections in the two ciyptograms is 15; this indicates that the width of the transposition 
rectangle is 15. Therefore, No. 3 (290 letters) has 5 long columns of 20 letters and 10 short 
columns of 19 letters [(15X20) -10=290], No. 6 (302 letters) has 2 long columns of 21 letters 
and 13 short columns of 20 letters [(15X21)- 13=302], The identical sections in No. 3 and 
No. 6 having been marked off as shown in figure 51, the next step is to transcribe the texts into 
their correct column lengths as given by the study of identical sections, writing them merely 
in their serial order, as shown in figure 52. In this transcription no serious difficulty is usually 
encountered in the division into correct column lengths, this process being gtiided by the identical 
sequences, {he number of letters between the identical sequences, and the maximum and minimum 
lengths of the columns as calculated from the dimensions of the rectangle. Whenever difficulties 
are encountered in this process, they are brought about by accidental identities of letters before 
and after the true or actual identical sequences. In the present case no such difficulties arise 
except in going from column 12 to column 13. The identical sections for column 13 here consist 
of the sequence A F F A A F; if these sections are placed at the head of column 13, it leaves column 
12 one letter short at the bottom in each diagram. This means that the. initial A’s in these 
identical sequences represent an accidental identity; these A’s belong at the bottom of column 
12 in each diagram, and the true identical sequences are F F A A F, and not A F F A A F. In 
some cases there may be many more instances of such accidental identities before and after the 
true identical sequences. Another thing to be noted is that the identical beginnings in this 
case run along for at least 4 complete rows and part of the fifth row in the transposition rectangle. 
Therefore, the identical sequences should consist of not less than 4, and not more than 5 letters; 
any letters in excess of 5 in any identical sequence are accidental identities. There are several 
such accidental identities in the case under study, viz, in columns 5 and 12. 



fi 
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Figure 52— Continued. 

c. Now comes the attempt to place the columns in proper sequence in the respective trans- 
position rectangles. Since No. 6 has only 2 long columns, viz, 5 and 14, it is obvious that these 
two columns belong at the extreme left of the rectangle. Their order may be 5—14 or 14—5; 
there is no way of telling which is correct just yet. Since No. 3 has 5 long columns, viz, 3, 4, 5, 
7, 14, and since from No. 6 it has been ascertained that 5 and 12 go to the extreme left, it is 
obvious that columns 3, 4, and 7 occupy the third, fourth, and fifth positions in the rectangles. 
Their order may be any permutation of the three numbers 3, 4, and 7 ; their exact order must be 
ascertained by further study. 
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d. In this study, to fix the exact order of the columns and thus to reconstruct the transposi- 
tion key, advantage can be taken of the diverse lengths of other cryptograms that may be 
available in the same key. In this case there are 6 additional cryptograms, Nos. 1, 2, 4, 5, 7, 
and 8, suitable for the purpose. The following calculations are made: 



Cryptogram 

No. 


Total number 
of letters 


Lengths of 
columns 


Number 

Long 


>f columns 
Short 


1 


60 


4 


All sam 


e length 


2 


38 


3 and 2 


8 


7 


4 


62 


5 and 4 


2 


13 


5 


74 


5 and 4 


14 


1 


7 


124 


9 and 8 


4 


11 


8 


54 


4 and 3 


9 


6 



Now No. 7 has 4 long columns, and these must consist of 4 columns from among the 5 already 
ascertained as falling at the extreme left, viz, 3, 4, 5, 7, and 14. Columns 5 and 14 have further- 
more been placed in positions 1-2, leaving columns 3, 4, and 7 for positions 3-4-5. Which 
of these three possibilities is to be omitted as a long column in No. 7? A means of answering 
this question involves certain considerations of general importance in the cryptanalysis of this 
type of system. 

e. Consider a transposition rectangle in which the number of columns is even, and consider 
specifically the first pair of columns in such a rectangle. The combinations of bipartite compo- 
nents formed by the juxtaposition of these 2 columns correspond to plain-text letters, and there- 
fore the distribution of the bipartite digraphs in these colu m ns will be monoalphabetic in char- 
acter. The same is true with respect to the bipartite components in the third and fourth columns, 
the fifth and sixth columns, and so on. Hence, if a long cryptogram of this nature is at han d, 
and if the 2 columns which belong at the extreme left can be ascertained, then a distribution of 
the bipartite digraphs formed by juxtaposing these columns should not only be monoalphabetic, 
but also this distribution, ij it is at all normal, will afford a basis for matching other columns which 
will produce similar distributions, for the text as a whole is monoalphabetic. In this way, by 
proper matching of columns, those which really go together to form the pairs containing the 
bipartite equivalents of the plain-text letters can be ascertained. From that point on, the solu- 
tion of th8 problem is practically the same as that of solving a columnar transposition cipher 
with nonfractionated letters. 

/. But now consider a plain-text rectangle in the ADFGVX system, in which the number of 
columns is odd, and consider specifically the first pair of columns in the rectangle. Now only the 
alternate combinations of bipartite components in these columns form the units of plain-text 
letters. The same is true of the bipartite components of the third and fourth, the fifth and sixth 
columns, and so on. In all other respects, however, the remarks contained in subparagraph e 
apply equally to this case where the width of the rectangle is odd. 

g. Returning to the problem under study, it has been ascertained that columns 5 and 14 fall 
at the extreme left. Whether their correct order is 5—14 or 14—5 cannot at the moment be ascer- 
tained, nor is it essential. The thing to do is to make a distribution of the bipartite pairs and 
see what it is like. Since the width of the rectangle here is odd, only the 1st, 3d, 5th, . . . pairs 
down the columns can be distributed in a frequency square. The results are shown in Fig. 53. 
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No. 3 

Col. Col. 
J5 14 

1 D A 

D A 
3 A A 

G F 
5 D D 

G A 
7 X D 

A A 
9 V D 

G X 
11 D V 

G V 
13 A A 

D X 
15 A F 

F V 
17 A A 

X D 
19 F D 

A G 



1 

3 

5 

7 

9 

11 

13 

15 

17 

19 

21 



No. 6 

Col. Col. 
_S 14 

D A 
D A 
A A 
G F 
D D 
G X 
G A 
D X 
A A 
A V 
G A 
G X 
F D 
D A 
D G 
D A 

V D 
F X 
F D 

V V 

V F 



2d Component 



G 




FlOUBX S3. 



h. The distribution is fairly good. Five occurrences of AA are noted, 3 of FD. These must 
represent high-frequency letters. The $ (Phi) test for monoalphabeticity may be applied. 

Expected value of <£for plain text=. 0667X21 X20=28. 01 
Expected valueof </> for random Jtext — .0385X21X20=16.17 

Observed value of <£ in this case=(5X4)-t-(2Xl) + (2Xl) + (3X2)-f-(2Xl) + (2Xl)=34 



The observed value of 4> is considerably greater than the expected value for plain text and more 
than twice as much as the expected value for random text. Using the distribution in figure 53 as 
a basis, an attempt is made to add to the 5-14 combination a colu mn selected from among columns 
3, 4, and 7, so that the second, fourth, sixth . . . pairs down the second and third columns in the 
rectangle will give bipartite pairs that will conform to the distribution noted in figure 53. Since 
the results sought will be very materially affected if the combination 5-14 should really be 14-5, 
all possible combinations of 5-14 and 14-5 with 3, 4, and 7 must be tried. The various combina- 
tions tested are shown in figure 54. 




iM!/' 



nKlAJfi 




( 1 ) 

5 14 3 

DAD 
D A V 
A A F 
G F D 
DDF 
G X D 
G A F 
D X F 
A A D 
A V D 
G A F 
G X D 
FDD 
D A F 
D G X 
D A F 

V D X 
F X X 
F D F 

V V D 

V F 
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No. 3 





(1) 


(2) 


(3) 


(4) 


(5) 


(6) 




5 


14 


_3_ 


5 


14 


4 


5 


14 


_7 


14 


5 


_3 


14 


_5_ 


_4 


14 


5 


jr 


1 


D 


A 


D 


D 


A 


F 


D 


A 


"d 


A 


D 


D 


A 


D 


"f 


A 


D 


"d 


2 


D 


A 


V 


D 


A 


D 


D 


A 


F 


A 


D 


V 


A 


D 


D 


A 


D 


F 


3 


A 


A 


F 


A 


A 


X 


A 


A 


F 


A 


A 


F 


A 


A 


X 


A 


A 


F 


4 


G 


F 


D 


G 


F 


A 


G 


F 


G 


F 


G 


D 


F 


G 


A 


F 


G 


G 


5 


D 


D 


F 


D 


D 


X 


D 


D 


D 


D 


D 


F 


D 


D 


X 


D 


D 


D 


6 


G 


A 


X 


G 


A 


V 


G 


A 


X 


A 


G 


X 


A 


G 


V 


A 


G 


X 


7 


X 


D 


A 


X 


D 


A 


X 


D 


D 


D 


X 


A 


D 


X 


A 


D 


X 


D 


8 


A 


A 


G 


A 


A 


D 


A 


A 


V. 


A 


A 


G 


A 


A 


D 


A 


A 


V 


9 


V 


D 


F 


V 


D 


X 


V 


D 


D 


D 


V 


F 


D 


V 


X 


D 


V 


D 


10 


G 


X 


X 


G 


X 


F 


G 


X 


A 


X 


G 


X 


X 


G 


F 


X 


G 


A 


11 


D 


V 


A 


D 


V 


X 


D 


V 


D 


V 


D 


A 


V 


D 


X 


V 


D 


D 


12 


G 


V 


F 


G 


V 


F 


G 


V 


A 


V 


G 


F 


V 


G 


F 


V 


G 


A 


13 


A 


A 


A 


A 


A 


D 


A 


A 


V 


A 


A 


A 


A 


A 


D 


A 


A 


V 


14 


D 


X 


F 


D 


X 


G 


D 


X 


D 


X 


D 


F 


X 


D 


G 


X 


D 


D 


15 


A 


F 


A 


A 


F 


A 


A 


F 


A 


F 


A 


A 


F 


A 


A 


F 


A 


A 


16 


F 


V 


X 


F 


V 


G 


F 


V 


D 


V 


F 


X 


V 


F 


G 


V 


F 


D 


17 


A 


A 


D 


A 


A 


F 


A 


A 


D 


A 


A 


D 


A 


A 


F 


A 


A 


D 


18 


X 


D 


D 


X 


D 


G 


X 


D 


D 


D 


X 


D 


D 


X 


G 


D 


X 


D 


19 


F 


D 


D 


F 


D 


G 


F 


D 


G 


D 


F 


D 


D 


F 


G 


D 


F 


G 


20 


A 


G 


D 


A 


G 


A 


A 


G 


A 


G 


A 


D 


G 


A 


A 


G 


A 


A 



( 2 ) 

5 14 4 

D A F 
DAD 
A A X 
G F A 
D D X 
G X G 
G A A 
D X X 
A A F 
A V F 
G A V 
GXD 
F D V 
D A A 
D G F 
DAG 

V D V 
F X D 
F D V 

V V D 

V F 



No. 6 
(3) 

5 14 7 

DAD 
D A F 
A A F 
G F G 
D D D 
GXG 
G A F 
D X D 
AAA 
A V A 
G A F 
GXG 
FDA 
D A X 
D G F 
D A F 

V D D 
F X V 
FDD 

V V D 

V F 

Figure 54. 



(4) 

14 5 3 

ADD 
A D V 
A A F 
F G D 
DDF 
X G D 
A G F 
X D F 
A A D 

V A D 
A G F 
X G D 
D F D 
A D F 
G D X 
A D F 
D V X 
X F X 
D F F 

V V D 
F V 



(5) 

14 5 4 

A D F 
ADD 
A A X 
F G A 
D D X 
X G G 
A G A 
X D X 
A A F 

V A F 
A G V 
X G D 
D F V 
ADA 
G D F 
A D G 
D V V 
X F D 
D F V 

V V D 
F V 



( 6 ) 

> 14_^__7 

ADD 
A D F 
A A F 
F G G 
D D D 
X G G 
A G F 
X D D 
AAA 

V A A 
A G F 
X G G 
D F A 
A D X 
G D F 
A D F 
DVD 
X F V 
D F D 

V V D 
F V 
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i. Frequency distributions are now made. If combination 5-14-3 is correct for No. 3, it is 
also correct for No. 6. Hence, a single distribution is made of the bipartite pairs in rows 1, 3, 5, 
... of columns 5-14, and of the pairs in rows 2, 4, 6, . . . of columns 14-3. Similar distribu- 
tions are made of the pairs given under each of the other combinations. These distributions are 
shown in figure 55. 



(1) [5-14-3] (2) [5-14-4] (3) [5-14-7] 
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(4) [14-5-3] 








(5) [14-5-4] 
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>) ii- 


4-5- 
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Figure m. 



j. These distributions are now tested for monoalphabeticity, by applying the <t> test. The 
number of occurrences in each distribution is 41. Then 41 X40X-0667= 109.4 is the expected 
value of <{> for plain text; 41X40X-0385=63.1 is the expected value of <t> for random text. 
Here are the calculations for the first distribution (combination 5-14-3) yielding the observed 
value of <j> as 82: 

(5X4) + (3X2) + (1X0) + (2X1) + (1X0) + 

(2X1) + (3X2) + (1X0) + (1X0) + (5X4) + (2X1) + 

(1X0) + (4X3) + (2X1) + (1X0) + (3X2) + (2X2) + (2X1)=82. 

The observed values of for all 6 frequency distributions are shown herewith: 

(1) =82 (4) — 120 

(2) =76 (5)= 70 

(3) = 78 (6) = 1 1 0 
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Only two of these distributions give close approximations to 109, the expected value of <f>, and 
they may be retained for further experiment. They are the ones for combinations (4) and (6) , 
with values of 120 and 110, respectively. 

k. Selecting combinations (4) and (6) viz, 14-5-3, and 14-5-7, since columns 14, 3, 4, 5 and 
7 form the group of 5 columns at the left of the transposition rectangle, the following combina- 
tions are possible: 



(1) 14-5-3-4-7 (3) 14-5-7-3-4 

(2) 14-5-3-7-4 (4) 14-5-7-4-3 



l. The following sets of columns correspond to these 4 combinations in the 2 cryptograms 
(fig- 56): 

No. 3 



( 1 ) 



( 2 ) 



( 3 ) 



( 4 ) 





J4 


8 


3 


4 


_7 


14 


5 


3 


7 


4 


14 


6 


7 


3 


4 


14_ 


5 


7 


4 


_3_ 


1 


A 


D 


D 


F 


D 


A 


D 


D 


D 


F 


A 


D 


D 


D 


F 


A 


D 


D 


F 


D 


2 


A 


D 


V 


D 


F 


A 


D 


V 


F 


D 


A 


D 


F 


V 


D 


A 


D 


F 


D 


V 


3 


A 


A 


F 


X 


F 


A 


A 


F 


F 


X 


A 


A 


F 


F 


X 


A 


A 


F 


X 


F 


4 


F 


G 


D 


A 


G 


F 


G 


D 


G 


A 


F 


G 


G 


D 


A 


F 


G 


G 


A 


D 


5 


D 


D 


F 


X 


D 


D 


D 


F 


D 


X 


D 


D 


D 


F 


X 


D 


D 


D 


X 


F 


6 


A 


G 


X 


V 


X 


A 


G 


X 


X 


V 


A 


G 


X 


X 


V 


A 


G 


X 


V X 


7 


D 


X 


A 


A 


D 


D 


X 


A 


D 


A 


D 


X 


D 


A 


A 


D 


X 


D 


A 


A 


8 


A 


A 


G 


D 


V 


A 


A 


G 


V 


D 


A 


A 


V 


G 


D 


A 


A 


V 


D 


G 


9 


D 


V 


F 


X 


D 


D 


V 
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D 
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D 
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D 
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D 
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D 
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10 
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F 


A 


V 


G 
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13 
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V 


A 


D 


A 


A 


V 


D 


A 


14 
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G 


D 


X 


D 


F 


D 


G 


X 


D 


D 


F 


G 


X 


D 


D 
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F 


15 
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A 


A 


A 


F 
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A 


A 


A 
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A 


A 


A 
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A 


A 
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16 
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F 
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F 
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A 


D 


D 


F 


A 


A 


D 


F 


D 


18 
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G D 
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Figure 56. 
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(i) 

14 B 8 4 7 _14_£ 

1 A D D F D AD 

2 ADVDF AD 

3 AAFXF AA 

4 FGDAG FG 

5 DDFXD DD 

6 XGDGG XG 

7 AGFAF AG 

8 XDFXD XD 

9 AADFA AA 

10 VADFA VA 

11 AGFVF AG 

12 XGDDG XG 

13 DFDVA DF 

14 ADFAX AD 

15 GDXFF GD 

16 ADFGF AD 

17 DVXVD DV 

18 XFXDV XF 

19 DFFVD DF 

20 VVDDD V V 

21 F V F V 
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No. 6 

(2) (3) 

3 7 4 14 S 7 3 4 

DDF ADDDF 

VFD ADFVD 

FFX AAFFX 

D G A FGGDA 

FDX DDDFX 

DGG XGGDG 

F F A AGFFA 

FDX XDDFX 

DAF AAADF 

DAF VAADF 

FFV AGFFV 

DGD XGGDD 

DAV DFADV 

F X A ADXFA 

XFF GDFXF 

FFG ADFFG 

X D V DVDXV 

X V D XFVXD 

FDV DFDFV 

DDD VVDDD 

F V 

Figure 50 -Continued. 



( 4 ) 

14 8 7 4 3 

A D D F D 

A D F D V 

AAFXF 
F G G A D 

D D D X F 

X G G G D 

AGFAF 
X D D X F 

A A A F D 

V A A F D 

AGFVF 
XGGDD 
D F A V D 

A D X A F 

G D F F X 

ADFGF 
D V D V X 

X F V D X 

D F D V F 

VVDDD 
F V 



m. The additional bipartite pairs given by adding columns 4-7 to the basic combination 
14-5-3 are distributed in the 4th frequency distribution square of figure 55, yielding the distri- 
bution shown in square (1) of figure 57. The other squares in figure 57 are constructed in the 
same way, for the other combinations of figure 56. 



(1) [14-5-3-4-7] 



(2) [14-5-3-7-4] 
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Figure 87. 




116 



(3) [14-5-7-3-4] (4) [14-5-7-1-3] 
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Figure 57— Continued. 



n. Again applying the 0-test, the expected value of 0 is 81 X80X .0667=432. The observed 
values for the four combinations of figure 57 are as follows: 

(1) For combination 14-5-3-4-7, 0=436 

(2) For combination 14-5-3-7-4, 0=276 

(3) For combination 14-5-7-3-4, 0=344 

(4) For combination 14-5-7-4-3, 0=318 

The combination 14-5-3-4-7, giving the greatest value for <f> (a little better than the expected 
value), is very probably the correct one. 

o. Examining the other cryptograms that are available, it is seen that No. 7 is the third 
longest one of the entire set, with 124 letters; moreover, the dimensions of the rectangle [(15X9) — 
1 1 = 124] are such as to bring about 4 long columns of 9 letters and 11 columns of 8 letters. The 
first 5 columns are definitely fixed in position, since it is known that the first 5 key n um bers are 
14-5-3—4-7 . The resulting diagram is shown in figure 58. There is now a section consisting of 



14 5 3 4 7 1 2 6 8 8 10 11 12 13 15 
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10 columns which are to be anagrammed to ascertain their correct sequence. The column to 
follow col umn 7 is ascertained on the basis of the repetitions which are brought about when the 
selected column is placed on the right. These repetitions should fall into those cells of frequency 
distribution (1), figure 57, which are of high frequency. In other words, the process is one of 
selecting from among columns 1, 2, 6, 8, 9, 10, 11, 12, 13, and 15 that column which will yield 
the most repetitions of bipartite digraphs with the digraphs given by the juxtaposition of columns 
14-5-3-4-7, as distributed in frequency square (1) of figure 57. The column thus selected turns 
out to be No. 10. Then other columns are added by proceeding along the same lines, the work 
becoming progressively more easy as the number of available candidates decreases. Sometimes 
the discovery of what appears to be a long repetition within one of the cryptograms or between 
two cryptograms facilitates the process. In this case the results obtained from the 3 crypto- 
grams under study are shown in figure 59. 
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p. What the cryptanalyst now has before hirn is a monoalphabetic substitution cipher, the 
solution of which presents no difficulties. The cipher square is reconstructed as completely as 
possible, blanks being left where there are no occurrences to give clues as to the character involved, 
usually some of the digits and the very infrequent letters. In this case the only letters which do' 
not occur in the plain text are Q, X, and Z. The digits 5 and 7 are recovered from the context, 
in message No. 6, where the caliber of a gun is mentioned and the digits are confirmed at other 
places in the message. The square that is obtained is seen in figure 60. Examination of the 
mixed sequence discloses that it is based upon the phrase THE FLOWERS THAT BLOOM IN THE 
SPRING. This permits of the establishment of the transposition key and of the position of the 
digits in the checkerboard (as in par. 38 i) . The results are shown in figure 61 . The completely 
solved messages are shown in figure 62. 
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1 2 3 4 5 # 7 8 9 10 11 12 13 14 15 

Literal key THEFLQWRSABMINPGCDJKQUVXYZ 
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Figure $2— Continued. 
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Figure 62— Continued. 



40. Special solution by the exact factor method. — a. The student who has comprehended 
the successive steps in the solution of the example discussed in the preceding paragraph is in a 
position to grasp at once the mechanics of the special solution by the exact factor method. The 
latter is based upon the interception of a number of cryptograms, preferably lengthy ones, which 
have been enciphered by rectangles in which the last row is completely filled with letters. The 
total number of bipartite components in the case of such a cryptogram will yield clues as to the 
dimensions of the transposition rectangle. Then the text is transcribed into columns of appro- 
priate length, all being equal in this respect, and the process of combining columns, as explained 
in paragraph 39e, is applied in order to produce the best monoalphabetic distribution of bipartite 
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digraphs down the juxtaposed columns. There is nothing to prevent the simultaneous use of 
all cryptograms that have been enciphered by completely filled rectangles, for it is clear that 
if, for example, columns 15 and 4 are to be paired in one cryptogram, the same columns will be 
paired in all the other cryptograms. Hence, even if the rectangles are small in depth they can 
be used in this process; it is necessary only that all columns of any rectangle be of the same 
length. Now if only two or three such pairs of columns can be set up correctly, solution follows 
almost as a matter of course. No additional or new principles need be brought into play, beyond 
those already possessed by the student. 

b. In this special solution, the important step is, of course, the initial one of experimenting 
with rectangles of various dimensions until the correct size has been hit upon. In some cases, 
excessive experimentation may not be necessary if the total number of characters is such as to 
yield only one or two possibilities with regard to the length of the columns. For example, suppose 
that previous work has established the fact that the enemy ,uses transposition rectangles not 
less than 15 and not more than 22 columns in width. A message totaling 703 letters would 
indicate a rectangle of 19 columns of 37 letters, since these two numbers are the only factors of 
703. If this then were corroborated by other cryptograms of 76 (19X4), 152 (19X8), 190 
(19X10) letters, the probability that 19 is the width of the transposition rectangle becomes quite 
persuasive. Of course, there will be and there should be other cryptograms of lengths that do 
not factor exactly; these represent the ones in which the rectangles are not completely filled in 
their last row. They do not enter into the solution at first, but just as soon as the positions of 
two or three key numbers become fixed, the data afforded by these messages become available 
for use in the later stages in thS“ solution. 

c. The exact-factor method is a useful one to know. For despite all instructions that 
may be drawn up insisting upon the advisability of not completing the last row of a transposition 
rectangle, the tendency to violate such a rule is quite marked, especially where a large ciypto- 
graphic personnel must be employed. It is not astonishing to find that for lazy or ignorant clerks 
the temptation to fill the rectangle completely is particularly hard to resist when it happens that 
a message falls just one, two, or three letters short of forming a completely-filled rectangle: 
it is so much easier for such clerks to handle a rectangle with equal-length columns than one in 
which this is not the case. Moreover, the number of errors and therefore the number of times a 
shiftless or careless clerk must go over his work to correct errors is reduced to a mi ni mum. 
Hence, it often happens that in such cases an enciphering clerk adds one, two, or three letters 
to complete the last row, thus leading to the transmission of not a few cryptograms enciphered 
by complgtely-filled rectangles. Space forbids giving an example of such a solution. 

41 . General solution for the ADFGVX system. — a. All three of the foregoing methods of 
solving cryptograms in the ADFGVX system fall in the category of special solutions and therefore 
are dependent upon the fortuitous existence of the special conditions required under each case. 
What is really desired in the practical situation is a method of solution which is not so dependent 
upon chance or good fortune for success. A search for a general solution was, of course, made 
during the time that the system was under minute study by the cryptanalytic agencies of the 
Allies, but no general solution was devised. All the solutions made during actual hostilities 
and for a number of weeks thereafter were of the special types described in the preceding para- 
graphs. The first published description of a general solution is to be found in Givierge’s Cours 
de Cryptographic, 1925, but only in broad outlines. A complete general solution was inde- 
pendently conceived by a group of cryptanalysts in the office of the Chief Signal Officer 5 and 
will be described in paragraphs 42 and 43. 

b. The attention of the student is directed to the comments made in paragraph 18, with 
regard to the significance of the term general solution in cryptanalysis. He must be cautioned 



* See footnote 7 of this section. 
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not to expect that in practical work a general solution will, in the cryptanalytic as in the mathe- 
matical field, invariably lead to a solution. If there is a sufficient amount of text and if the text 
contains no abnormalities, the attempt to apply the general solution will usually be successful. 
But the cryptanalyst must remember that the ADFGVX system is by no means a simple one to 
solve even under the best of conditions and if there is only a small amount of text, if it happens 
that the transposition key is unusually long, or if the text is abnormal, he may not succeed in 
solving the messages by the straightforward method to be set forth below, and he may have to 
introduce special modifications. For the latter he can only rely upon his own ingenuity and 
intuition. 

42 . Basic principles of the general solution. — a. Every transposition rectangle in the 
ADFGVX system must conform to one or the other of two and only two fundamental types: the 
number of columns must be either odd or even. A number of important consequences follow from 
this simple fact, some of which have already been pointed out in paragraph 39c. They will be 
elaborated upon in the next subparagraphs. 

b. Consider a rectangle with an even number of columns. Each of its rows contains an 
even number of bipartite components, half of which are initial components, half, final compo- 
nents, alternating in a regular order from left to right in the rows. When the transposition is 
applied, all the components within a given column are of the same class, either initial or final. 
No intermixture or alternation of the two classes is possible. On the other hand, consider a 
rectangle with an odd number of columns. Each of its rows contains an odd number of bipartite 
components, the 1st row containing one more initial component than final components, the 2d 
row containing one more final component than initial components, and so on, this arrangement 
alternating regularly in the successive rows of the rectangle. Wlien one studies the various 
columns of the rectangle, it is seen that in each column there is a perfectly regular alternation of 
initial and final components, the odd columns (1st, 3d, 5th, . . . ) beginning with an initial 
component, the even col umns (2d, 4th, 6th, . . . ) beginning with a final component. This 
alternation in components remains true even after the transposition is applied. These remarks 
become very clear if one studies figure 63. Two transposition rectangles are shown, one with 
an even number of columns, the other with an odd number. Instead of the actual components 
(ADFGVX), the symbols 0, and 0 2 are used to indicate the two classes of components, initial and 
final, because in this analysis interest centers not upon the actual identity of a component but 
upon the class to which it belongs, initial or final. At the top of each column is placed a “plus” 
to denote a col umn occupying an odd-numbered position in the rectangle, or a “minus” to denote 
a column occupying an even-numbered position. 
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Fiodbe 83. 

c. In what follows, the term “odd column” will mean merely that the column in question 
occupies an odd position (1st, 3d, 5th, . . .) in the transposition rectangle; the term “even 
column,” that it occupies an even position (2d, 4th, 6th, . . .) in the rectangle. The odd or 
even designation has no reference whatever to the nature of the transposition key number appli- 
cable to that column, whether it is odd or even. Now when the transposition is applied to the 
even-width rectangle a, figure 63, the cryptographic text will consist of a number of sections of 
letters, each section corresponding to a column of the rectangle, and therefore the number of 
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sections in this case will be even. Moreover, all the components in a section corresponding to 
an odd column in rectangle a will be 0j or initial components, all those in a section corresponding to 
an even column, 0 2 or final components. The sections or columns are completely homogeneous with 
respect to the class to which their constituent components belong. On the other hand, when the 
transposition is applied to odd-width rectangle b, the cryptographic text will consist of an odd 
number of sections, each corresponding to a column of the rectangle. The components in the 
sections consist of members of both classes of components in a regular alternation; in a section 
corresponding to an odd column the order is 9i^>9 a -»0i . . in a section corresponding to an 
even column the order is 0 3 — >0i— >0 2 .... The sections or coliimns are not homogeneous in this 
case as they are in the former. 

d. Now if there were some way of distinguishing between initial components as a class and 
final components as a class it is clear that it may be possible first of all to ascertain whether the 
transposition rectangle contains an even or an odd number of columns. Secondly it may be 
possible to identify those columns which are even and those which are odd. Finally, it may be 
possible to ascertain which are the long columns and which are short, thus yielding the exact 
outlines of the rectangle in case the last row is incompletely filled. From that point on, solution 
follows along the same lines as explained in paragraph 40, with the modification that in the pair- 
ing of columns the number of possibilities is greatly reduced, since it is useless to pair two columns 
both containing initial components or final components. 

e. The foregoing depends then upon the possibility of being able to distinguish as a class 
between initial and final components of the bipartite cipher equivalents in this system, or at 
least between letters belonging to one or the other of these two general classes of components. 
Now if the substitution checkerboard has not been consciously manipulated with a view to 
destroying certain properties normally characterizing its rows and columns, the sort of differenti- 
ation indicated above is quite possible. For example, if in the checkerboard shown in figure 61 
the normal frequencies of the letters as they appear in English telegraphic plain text 8 are inserted 
in the cells and totals are obtained vertically and horizontally, these totals will permit of assign- 
ing frequency weights to the letters ADFGVX as initial and as final letters of the bipartite cipher 
equivalents of the plain-text letters. This is shown below in figure 64. The bipartite letter A 
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* As given in fig. 3, p. 13, Military Cryptanalysis, Part 1. 
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has a frequency value of 284 as an initial component of the bipartite cipher equivalents of plain- 
text letters, and a frequency value of only 169 as a final component. 

Similarly, the letters V and X have frequency values of 47 and 69, respectively, as initial com- 
ponents and 120 and 198 as final components. It is obvious, then, that in this checkerboard the 
weighted frequency values of the letters A, V, and X as initial components differ considerably from 
the values of these same letters as final components, the value for G as an initial is only a little 
less than its value as a final, the values of D and F as initials are only a little more than their 
values as finals. But it is the wide variations in the weighted frequency values of certain of the 
letters as initial components and as final components, exemplified in the case of A, V, and X, 
which form the basis of the general solution, because these wide variations afford a means for 
making the various differentiations noted in subparagraph d. 

j. Of course, in working with an unknown example, the composition of the checkerboard is 
unknown and therefore no accurate frequency weights may be assigned to the ADFGVX com- 
ponents in the cryptograms. However, it is still possible to arrive at some approximations for 
these weights in case there are several cryptograms available for study, as would normally be 
true in actual practice. How this can be done will be shown very soon, by studying an example. 
For the purposes of this study the set of 12 cryptograms given below will be used. 



VDDGG GVFDF VDVVF VDGAD DAFFF 

VDXFD DXDVX ADVDV FXGDF VADDG 

DGDGV GDDDF XFADA VDVGD GADXV 

DADAD FXAVF VDDAA VDFFD FVGDF 



V D D G V 
F V G F V 
F D D X A 
A F F V F 
D D G D V 



D D D D A 
D G A D V 
D F G D A 
A F X G F 
X A X F D 



V A D A F 
F X V X D 
G X D D A 
X D G V A 



A D D X A 
G D D A G 
V F D A F 
D F V D G 



D X (212 letters) 



D D G A D 
G D D X F 
G V F V F 
G A V G G 



V D A A V 

V A G D D 

F V A X V 

V F G D F 

A A A X D 



D D F X F 
F A X D V 
X A V G D 
V D X A V 



X D D A X 
A V D V D 
VDXFD 
X D D V G 



D X G (108 letters) 



G X F X D 
D F V F V 
X D G A X 
D D V G V 



D F X A D 
F F G D G 
G F G G F 
A G F X F 



D A G A A 
F X F D X 
V G D G X 



F G A G V 
D D A G A 
D D D A V 



D A F G G 
D D G V A 
F V D D F 



X F D X D 
D D V D D 
D A A A A 



F V V X G 
G A F G A 
D X A G D 



XAGGD DAVGV FGDVF VDGGX GGAFF 

VFDAX GDDDG DAFDA DGGAD DGDXA 

FVDFD XFVGD DVAVF DDDVF AGDFF 

FXAAD FADGG VFDAV DGXFV DAAVG 

DXFGG DDXGD A (186 letters) 
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IV 



ADXVF XVGGV 


F D D V A 


F G A A V 


F D G V D 


DDGDG FDVVA 


F G X F X 


FDDDD 


V G D A X 


DAXDD DAGVF 


F A A D V 


G D F X G 


X G V G D 


DDDAD VXVFA 


V D A X X 


D F A A F 


A V D V G 


VDVDD A X D A A 


(110 letters) 








V 






DFXFD DVVVD 


XFXFX 


F F F V A 


G F D X A 


VDAGF DVDGF 


A D A A D 


F D V F G 


D A D F V 


FVFXG XDDAG 


DV'GVF 


D G X X D 


F F G D G 


XGVDD VDDFG 


F V G D D 


V F V A G 


X X D F V 


DXAVF GAGAG 


A X D V D 


FXGVG 


D A D D X 


AGXDA DFDGX 


F D G G F 


V G X V V 


G D D D A 


GXVDG VDVGX 


DDFDD 


V A G A A 


D G D D F 


DGAGD FDDDD 
A D (202 letters) 


X G V G V 


G G G D G 


X D F G F 




VI 






GDGFX AGVFV 


D D X G X 


D V D D A 


X D A A X 


FAGVG DXFFV 


X F A D G 


F F D X A 


A F V X F 


DFXFV GDGFX 


F D V V X 


V G D F V 


D D V F D 


FVVDV DGGVF 


X F G V X 


FFVGV 


DDGDD 


DDGDD AVGVX 


G A F F X 


F V D D D 


(120 letters) 




VII 






GAFGF FXFVF 


G F X A V 


A G G X D 


X X D D F 


AGVDD VDVFF 


A D A V A 


V F V G G 


A D A A F 


VFDFV DXFXX 


G D X D D 


F V D F F 


X D V F X 


VADXV AXDVX 


A F F V D 


F D G X F 


D G F D D 


FVDVV AAFVF 


F V X D G 


F D D V A 


DDFDD 


DXFFA GFXFX 


A A G V D 


G G V D F 


G G G X D 


FDFVA FFGFX 


G D A X D 


G D G G D 


D A V D X 


ADFAF VFXDD 


X V A G D 


V V D D F 


X D G X X 


DVFVF DDDDA 


A F D F X 


D X G D A 


A F V D F 


DVDDV ADDVD 
D F V D (254 letters) 


V A V D G 


A F V F X 


F A A V D 




VIII 






DGVVG FXGGG 


ADFAF 


V V V A X 


A V G G V 


VDVGV VDAVG 


D G D G A 


V F D D A 


DDDXI 


DXFVF XGVGG 


D G D F G 


G D A D F 


D D X A V 


FDDVF ADXGD 


A D G V A 


F F X A D 


F A D X D 


GFADF DDGVD 


V X A V A 


D D X F F 


A G D X F 


FVFGF GFDFD 


V D X X D 


D G G D (144 letters) 
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IX 



G 


D 


D 


D D 


X V 


G 


V 


D 


V 


D 


A 


V 


G 


F 


G D 


F V 


D 


V 


A V 


D 


G 


F 


A 


G X 


A V 


F 


F 


G 


V 


A 


D 


D 


D 


A 


X X A X 


D 


G 


A 


D 


G 


X A V 


V D 


G X 


X 


A 


A 


A 


V 


A 


D 


A 


D 


G X 


D V 


G 


D 


D 


D 


D 


G 


V 


F 


X A 


A V 


G 


G 


V 


F 


X 


D 


A 


F 


D 


G V 


G A 


F 


G 


D 


D 


F 


A 


V 


V 


G D 


D V 


D 


F 


X 


D 


V 


D 


G F 


V 


A A 


G D 


X 


F 


D 


V 


A 


A 


D 


A 


G D 


A X 


F 


V 


G 


D 


D 


D 


A 


G 


V 


A V 


F G 


X X 


F 


D 


D 


G 


X 


F 


V D 


G G 


D 


A 


V 


D 


A 


G 


G 


F 


D 


A X 


D X 


F 


F 


V 


G 


F 


A X X 


A D 


D F 


(182 letters) 












































X 






















D 


G 


D 


D F 


V F 


A 


V 


D 


V 


F 


D 


A 


D 


G 


F V 


G V 


G 


G 


D 


F V 


D 


V 


V 


X D 


D F 


D 


D 


V 


G 


X 


G 


V 


D 


X 


G V 


G D 


X 


D 


G D 


X 


F 


X 


F 


D X 


V D 


A 


A 


D 


D 


F 


X D 


D 


A 


F F 


A A 


F 


V 


F 


AG *-• 


D 


A 


A 


G G 


F A 


X 


G V 


X 


X 


F 


X 


A 


D 


G D 


F D 


G X 


G 


D 


A 


D 


A 


X 


G V 


V V 


D 


A 


A 


G 


G 


V 


F 


G 


V 


A V 


F V 


A 


A 


G 


A 


X 


G 


X 


D 


G A 


(130 letters) 
















































XI 




















V 


F 


D 


D V 


A X 


G 


D 


A 


D 


F 


G 


G 


G 


GFG 


D D 


F 


X 


X 


D 


A 


F 


D 


D 


X G 


G A 


V 


G 


A 


G 


D 


V 


D 


F 


D 


F D 


D D 


G A 


F 


A 


F 


D 


A 


A 


A G 


V A 


V 


F 


G 


G 


V 


A 


D 


D 


G 


D D 


F G 


F 


V 


D D 


A 


D 


F 


G 


A F 


D F 


V 


D 


D 


F 


V 


V 


V 


A 


D 


A G 


D X 


F 


XXX 


F 


F 


D 


X 


G D 


F D 


G 


F 


D 


D 


F 


G 


D 


A 


G 


F A 


A G 


G 


A 


D 


X 


D 


G 


V 


D 


G A 


V G 


V 


D 


F 


D 


D 


F 


X G 


A G X 


F G 


V 


F V 


V 


D 


G 


V 


D 


X D 


F F 


F 


X 


G 


X 


G 


X 


A 


G 


A 


G V 


G D 


V V X G 


F 


V 


D 


X 


D D 


X F 


V 


D 


D 


X 


(186 letters) 


































XII 




















X 


F 


D 


F X 


V V 


D 


V 


D 


A 


V 


D 


A 


D 


V 


F A 


G D 


G V 


A 


D 


D 


F 


D 


A 


A D 


X A 


D 


F 


V 


G 


V 


D 


G 


F 


X 


F G 


D V 


F 


V 


D 


D 


D 


D 


G 


D 


V V 


A V 


V 


V 


F 


A 


D 


D 


A 


X 


A V F 


V A 


D 


A 


X 


D 


V 


G 


D 


D 


F A 


X D 


D 


G 


X 


G 


V 


F 


X 


A 


V 


X V 


F D 


G 


D 


X 


D 


F 


D 


V 


X 


A D 


V A 


V 


A 


V 


G 


V 


D 


D 


D 


A 


F D 


F A 


D 


V 


F 


F 


V 


V 


G 


D 


A G 


F X 


D 


D 


F 


A 


D 


V 


X 


V 


D 


F X 


F F 


V 


V 


G 


F 


X 


X G 


F 


V A 


V F 


A 


G 


G 


D 


A 


V 


V 


D 


X 


D X 


G D 


D 


V 


V 


A 


D 


D 


D A 


G A 


A G 


X 


F 


G 


D 


D 


D 


G 


V 


F 


G F 


V G 


V 


X 


G 


V 


F 


D 


F 


F 


D A 


A D 


V 


D 


D 


X 


G 


D 


F 


D 


D 


V D 


D G 


A 


F 


G 


D 





(224 letters) 



43. Illustration of solution. 7 — a. Since the initial letters of all 12 cryptograms are in the 
same class, that is, either initial or final components, they may all be combined into a single 
distribution. Furthermore, since it is certain that regardless of whether the transposition rectangle 
has an odd or an even number of columns the 3d, 5th, 7th .. . letters of the cryptograms are in 

7 This illustration uses the same cryptograms and follows quite closely along the lines employed in a tech- 
nical paper of the Signal Intelligence Service entitled General Solution for the ADFGVX Cipher, prepared by 
Messrs. Rowlett, Kullback, and Sinkov, in 1934. 



\\is\lQ if HOils y;Xi ? 



the same class as the first letter, the 3d, 5th, 7th • • ■ letters may be added to the distribution, 
so long as these odd letters come from the same section (column 1). It is, however, necessaiy 
to limit the number of letters taken from the beginning of any one cryptogram to a reasonable 
length of column, depending on the size of the cryptogram. Assuming it is known that the 
enemy is using transposition keys of not less than 15 nor more than 22 numbers, the latter could 
be taken as the maximum possible size. But to be on the safe side it will be here assumed that 
a transposition rectangle of not more than 25 columns is being used. Hence, so far as concerns 
ciyptogram I, which has 212 letters, on the basis of a key of 25 numbers [(25X9) — 13=212] 
there will be 12 columns of 9 letters and 13 columns of 8 letters. Since there is no way of telling 
which are long and which are short columns, it will be safer to work on the basis of columns of 
8 letters. Therefore, the first 8 letters of cryptogram I are to be taken. In the case of crypto- 
gram II, with 108 letters, its first 4 letters will be taken, and so on, through the 12 cryptograms, 
the number of letters to be taken in each case being governed by the length of the cryptogram. 
The sections taken in the case of the 12 cryptograms are shown in figure 65. 




Letters taken 



VDDGGGVF 

VDAA 

DAGAAFG 

ADXV 

DFXFDDW 

GDGF 



Cryptogram 




Letters taken 



GAFGFFXFVF 

DGWG 

GDDDDXV 

DGDDF 

VFDDVAX 

XFDFXWD 




b. The odd and the even letters of these 12 sections are then distributed separately, the 
results being shown in figures 66 and 67. A consideration of the mechanics of this system leads 
to the expectation that if the transposition rectangle has an even number of columns the two distri- 
butions will be similar; if it has an odd number, they will be different. The similarity or difference 
between the two distributions is usually discernible with as few as 20 or 25 letters. 



Odd (1st, 3d, . . .) letters 

A D F G V X 

in miiiinuwtm 

nu /// ttu / 



Even (2d, 4th, . . .) letters 

A D F G V X 

m m, f m "" 1 



c. Letters V and X are of high frequency in the odd positions (fig. 66) but of low frequency 
in the even positions (fig. 67), whereas the letter F is of low frequency in the odd positions and of 
high frequency in the even positions. There can be no question that the two distributions are 
dissimilar, and the indications arp clear that the transposition rectangle involves an odd number 
of columns. 

d. Now the letters in figure 66 may be initial components, those in figure 67, final com- 
ponents, or the reverse may be the case. At the present stage of the study it is impossible to 
ascertain which of these alternative hypotheses is correct. However, this information is really 
immaterial at this stage. Suppose the letters in figure 66 are arbitrarily designated as class 1 
components, those in figure 67 as class 2 components. Class 1 components (fig. 66) are charac- 
terized by a predominance of V’s and X’s (over their frequencies in fig. 67) ; class 2 components 
(fig. 67) are characterized by a predominance of F’s (over its frequency in fig. 66). 
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e. The two distributions in figures 66 and 67 apply to the letters which come from column 1 
of the transposition rectangles for the 12 cryptograms understudy. In this column, the V’s and 
X’s fall predominantly in the odd positions, the F’s fall predominantly in the even positions. 
Therefore, beginning with position 1, the components in this column show an alternation of the 
type 0 !— > 0 2 — » 0j. By referring to figure 63 it will become clear that if class 1 components are 
initial components, then it must follow that column 1 occupies an odd position in the transpo- 
sition rectangle; but if class 1 components are final components, then it must follow that column 
1 occupies an even position in the transposition rectangle. Which of these alternatives is true 
cannot be ascertained at the moment. But the important point to be noted is that a definite reversal 
in the type of alternation of class 1 and class 2 components indicates the transit , in the transposition, 
jrom the end of one column to the beginning of the next column. That is, if it is found that from the 
beginning of the cryptogram the alternation of components is 0j-> 0 2 -» 0j and after a number 
of letters this alternation changes to 0 3 — » 0 t — > 0 2 , the point where this change occurs marks the 
end of column 1 and the beginning of the column 2. For the sake of brevity in reference, in the 
subsequent paragraphs the type of alternation 0j-> 0 2 -» 0! will be designated as the “fr type,” 
and this type of alternation characterizes columns which fall in the odd positions in the trans- 
position rectangle i. e., in the l at , 3 d , 5 th , 7 th , . . . positions from the left. The other type, 
0 2 — >0i— >0 2 will be designated as the “ — type,” and this type of alternation characterizes columns 
which fall in the even positions in the transposition rectangle i. e., in the 2 d , 4 th , 6 th , 8 th , . . . 
positions from the left. 

f. With these principles in mind, let cryptograms III and XI, each containing 186 letters, be 
studied. They may be superimposed, since they have identical numbers of letters and therefore 
the columns end at exactly the same points in both cryptograms. 





1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


14 


15 


16 


17 


18 


19 


20 


21 


22 


23 


HI. 


D 


A 


G 


A 


A 


F 


G 


A 


G 


V 


D 


A 


F 


G 


G 


X 


F 


D 


X 


D 


F 


V 


V 


XI. 


V 


F 


D 


D 


V 


A 


X 


G 


D 


A 


D 


F 


G 


G 


G 


G 


F 


G 


D 


D 


F 


X 


X 




24 


25 


26 


27 


28 


29 


30 


31 


32 


33 


34 


35 


36 


37 


38 


39 


40 


41 


42 


43 


44 




46 


III. 


X 


G 


F 


X 


F 


D 


X 


D 


D 


A 


G 


A 


D 


D 


G 


V 


A. 


P 


D 


V 


D 


D 


G 


XI. 


D 


A 


F 


D 


D 


X 


G 


G 


A 


V 


G 


A 


G 


D 


V 


D 


F 


D 


F 


D 


D 


D 


G 




47 


48 


49 


50 


51 


52 


53 


54 


55 


56 


57 


58 


59 


60 


61 


62 


63 


64 


65 


66 


67 


68 


69 


III. 


A 


F 


G 


A 


V 


G 


D 


G 


X 


D 


D 


D 


A 


V 


F 


V 


D 


D 


F 


D 


A 


A 


A 


XI. 


A 


F 


A 


F 


D 


A 


A 


A 


G 


V 


A 


V 


F 


G 


G 


V 


A 


D 


D 


G 


D 


D 


F 




70 


71 


72 


73 


74 


75 


76 


77 


78 


79 


80 


81 


82 


83 


84 


85 


86 


87 


88 


89 


90 


91 


92 


III. 


A 


D 


X 


A 


G 


D 


X 


A 


G 


G 


D 


D 


A 


V 


G 


V 


F 


G 


D 


V 


F 


V 


D 


XI. 


G 


F 


V 


D 


D 


A 


D 


F 


G 


A 


F 


D 


F 


V 


D 


D 


F 


V 


V 


V 


A 


P 


A 




93 


94 


95 


96 


97 


98 


99 


100 


101 


102 


103 


104 


105 


106 


107 


108 


109 


110 


111 


112 


113 


114 


115 


III. 


G 


G 


X 


G 


G 


A 


F 


F 


V 


F 


D 


A 


X 


G 


D 


D 


D 


G 


D 


A 


F 


D 


A 


XI. 


G 


D 


X 


F 


X 


X 


X 


F 


F 


D 


X 


G 


D 


F 


D 


G 


F 


D 


D 


F 


G 


D 


A 




116 


117 


118 


119 


120 


121 


122 


123 


124 


125 


126 


127 


128 


129 


130 


131 


132 


133 


134 


135 


136 


137 


138 


III. 


D 


G 


G 


A 


D 


D 


G 


D 


X 


A 


F 


V 


D 


F 


D 


X 


F 


V 


G 


D 


D 


V 


A 


XI. 


G 


F 


A 


A 


G 


G 


A 


D 


X 


D 


G 


V 


D 


G 


A 


V 


G 


V 


D 


F 


D 


D 


F 




139 


140 


141 


142 


143 


144 


145 


146 


147 


148 


149 


150 


151 


152 


153 


154 


155 


156 


157 


158 


159 


160 


161 


III. 


V 


F 


D 


D 


D 


V 


F 


A 


G 


D 


F 


F 


F 


X 


A 


A 


D 


F 


A 


D 


G 


G 


V 


XI. 


X 


G 


A 


G 


X 


F 


G 


V 


F 


V 


V 


D 


G 


V 


D 


X 


D 


F 


F 


F 


X 


G 


X 




162 


163 


164 


165 


166 


167 


168 


169 


170 


171 


172 


173 


174 


175 


176 


177 


178 


179 


180 


181, 


182 


183 


184 


III. 


F 


D 


A 


V 


D 


G 


X 


F 


V 


D 


A 


A 


V 


G 


D 


X 


F 


G 


G 


D 


D 


X 


G 


XI. 


G 


X 


A 


G 


A 


G 


V 


G 


D 


V 


V 


X 


G 


F 


V 


D 


X 


D 


D 


X 


F 


V 


D 



1 85 188 

III. D A 
XI. D X 



FlOVBX 884 
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g. It has already been noted that beginning with the first letter of any one of the crypto- 
grams, the type of alternation for column 1 is +. It is therefore not astonishing to find, within 
the first 10 letters, an alternation of the + type. Note how the V’s and X’s fall in the odd posi- 
tions, the F’s in the even. Thus: 

1234567 89 10 

III. DAGAAFGAGV 
XI. VFDDVAXGDA 

It is seen that there are 2 V’s which fall in odd positions (1 and 5), but one V falls in an even 
position (10). There is an X, which falls in an odd position (7) ; there are 2 F’s which fall in even 
positions (2 and 6). Unquestionably, then, the type of alternation, at least for the first 10 
letters in each of these cryptograms, is +. 

h. Take the next section of 10 letters in these two cryptograms. The letters are as follows: 

1 1 12 13 14 15 16 17 18 19 20 

III. DAFGGXFDXD 
XI. DFGGGGFGDD 

Here there are 4 F’s; 3 of them fall in odd positions (13, 17, 17), and one falls in an even position 
(12). There are 2 X’s ; onefallsin an odd position (19), one in an even position (16). Thereareno 
V’s among these letters. So far as the evidence afforded by the F’s is concerned, it would appear 
that this section of text shows the type 2 or “ — type” of alternation of components, since in 
type 1 or “ + type” the F’s occupy even positions and here the majority of them occupy odd 
positions. But so far as the X’s are concerned, the evidence is equally balanced: one X falls in an 
odd position, one in an even position. There being no V’s, no conclusions can be drawn from this 
letter. To be guided solely by the evidence afforded by the 3 F’s may be unwarranted. Is it 
not possible to weight the frequencies of the letters so that it will be unnecessary to rely merely 
upon a few of them and the evidence afforded by all the letters can be taken into account? Why 
not assign frequency weights according to the two distributions in figures 66 and 67? The figures 
then become as follows: 



Odd (1st, 3d, . . .) letters 
A D F G V X 

§ g 5 g g g 



Even (2d, 4th, . . .) letters 

A D F G V X 




Total- 3 +11+3 + 8+11+ 6 -42 letters 

Figure 69. 



Total = 4+10+11+5 + 4 + 1 -35 letters 



Since the-odd letters have a total frequency of 42, the even, a total frequency of 35, for purposes 
of equalizing the distributions in applying the weights it seems advisable to deduct one-sixth 
from the total when applying the weights to odd letters. 

i. Now in applying these weights to the letters, it must be borne in mind that since a trans- 
position rectangle with an odd number of columns is involved, half of the letters are class 1 com- 
ponents, the other half are class 2 components. Hence, in findin g the frequency value of the 
letters it is necessary to apply the weighted frequencies to alternate letters in the sections, as 
shown in figure 70. 

11 12 13 14 15 16 17 18 19 20 

III. DAFGGXFDXD 
XI. DFGGGGFGDD 



Distribution of odd letters Distribution of even letters 

A D F- G V X A D F G V X 




f- 08330 /- 131401 



fiaun 7a 



I 
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These distributions, when evaluated in accordance with figure 69, yield a total frequency value 
of 126; when evaluated in accordance with figure 69 reversed, yield a total frequency value of 
143. The detailed calculations are as follows: 

On the basis of figure 69 normal (odd letters as 0,’s, even letters as 0,’s): 

0(3) +3(11) +3(3) +3(8) +0(11) + 1(6) =72 

72 

72-— =60 
6 

1(4) +3(10) + 1(11) +4(5) +0(4) + 1(1) = 66 =66 



Total =126 

On the basis of figure 69 reversed (even letters as G^s, odd letters as 0 2 ’s) : 

1(3) +3(11) + 1 (3) +4(8) +0(11) + 1(6) =77 

77 

77- t =64 

0(4) +3(10) +3(11) +3(5)+ 0(4) + 1(1) =79 . =79 

Total =143 

j. Now the frequency sums here obtained (126 vs. 143) indicate that an alternation of the 
type 0 2 — >0,— >0 2 is in effect, that is, if a beginning is made with position 11, the type of alterna- 
tion is “ — Since the type of alternation for the first 10 letters is “ + ” and for the second 
10 letters the reversal in alternation would indicate that col umn 1 of the transposition 

rectangle ends somewhere near the 10th letter. This same sort of reversal takes place after the 
20th letter, as shown by the calculation in figure 71. 

21 22 23 24 25 2fl 27 28 29 30 

XIX. FVVXGFXFDX 
XI. FXXDAFDDXG 



Distribution of odd letters 

A D F G V X 



Distribution of even letters 

A D F G V X 



2 113 



/= 0 2 3 1 1 3 



On the basis of figure 69 normal (odd letters as G/s, even letters as 0 2 ’s): 
1 (3) +2(11) + 2(3) + 1(8) + 1(11) +3 (6) =68 

68 

68— -=57 
6 

0(4) +2(10) +3(11) + 1(5)+ 1(4) + 3(1) =65 =65 

Total =122 



On the basis of figure 69 reversed (even letters as 0i’s, odd letters as 0 2 ’s) : 
0(3)+2(ll)+ 3(3) + 1(8) + 1(11) +3(6) =68 

68 

68 =57 

6 

1(4) +2(10) +2(11) + 1(5)+ 1(4)+3(1)=58 =58 ~ 



Total=115 



ywcMt 7i. 



134 



Beginning with the 2 1 st position, the alternation is of type 0r->0j-*6i ; hence it is of the “ + ” type . 
Again the reversal in type of alternation occurs in passing from the 2d set of 10 letters to the 3d 
set, and this indicates that column 2 of the transposition rectangle ends somewhere near the 20th 
letter. But, fortunately, this time the exact location of the break is definitely indicated: The 
simultaneous appearance of V and X in the sequent positions 22 and 23 leads to the idea that the 
22d letter marks .the end of column 2 and the 23d letter marks the beg inning of column 3. There is 
nothing of an absolute nature in this ‘point: It is merely an indication based upon probabilities and 
does not constitute a conclusive proof by any means. Now if there is this definite break at the 
end of 22 letters it means that columns 1 and 2 must each eontain 11 letters. The calculations 
have heretofore been based upon sections of 10 letters and the results are therefore modified as 
shown in the following calculation: 



First Section Getters 1-11) 

123456 789 10 11 

III. DAGAAFGAGVD 
XI. VFDDVAXGDAD 

Distribution of odd letters Distribution of even letters 



A D F G V X 



/- i 



A D F G V X 



/- 5 



Weighted values of distributions: 

On the basis of figure 69 normal (odd letters as Gt’s, even letters as 0,’s) : 
1(3)+5(11) + 0(3) +3 (8) +2(11) + 1(6) = 110 

110-^=92 

5(4) + 1(10) +2(11) + 1(5)+ 1 (4) +0(1) =61 =61 



4 



Total=153 

On the basis of figure 69 reversed (even letters as 0j’s, odd letters as 0,’s) : 

5(3) + 1(11)+ 2(3) + 1(8) + 1(11) +0(6) =51 

51 42 

6 

1(4) +5(10) +0(1 1) +3(5) + 2(4) + l(l)=78 =78 



The type of alternation is 0i-*0 s -»0i, or “+”. 



Total =120 



Second Section (letters 12-22) 

12 13 14 15 18 17 18 19 20 21 22 

III. AFGGXFDXDFV 
XI. FGGGGFGDDFX 



Distribution of odd letters 

A D F G V X 




/- 0 1 5 3 0 1 



Distribution of even letters 



A D F G V X 




/- 1 3 1 4 1 2 
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Weighted values of distributions: 

On the basis of figure 69 normal (odd letters as 0/s, even letters as © 2 ’s) : 

0(3)4-1(11) +5 (3) 4-3(8) 4-0(1 1)4- 1(6) =56 

56-5?- 47 
6 

1(4) 4-3(10) -f- 1(H) +4 (5) 4- 1(4)+2(1)=71 =71 

Total=118 

On the basis of figure 69 reversed (even letters as 0j’s, odd letters as 0 2 ’s) : 

1(3)4-3(11)+ 1 (3) +4(8) + 1 (11) +2(6) =94 

94-—= 78 
6 

0(4) + 1(10) +5(11) +3(5)+ 0(4) + l(l)=81 =81 

Total=159 

Since the distribution here begins with an even-numbered position (12), and the greatest 
total is obtained on the basis of figure 69 reversed, the type of alternation for the second section 
of 11 letters is therefore again 0i— »© 3 -> 0 j, or “ + ”. 

Thibd Section (letters 23-33) 

III. VXGFXFDXDDA 
XI. XDAFDDXGGAV 

Distribution of odd letters Distribution of even letters 

ADFGVX ADFGVX 




/- 2 



/- 1 



Weighted values of distributions: 

On the basis of figure 69 normal (odd letters as 0i’s, even letters as 0 3 ’s) : 

2(3)+3(ll)+ 0(3) +2(8) +2(11) +3(6) =95 

95-^= 79 
6 

1(4) +3(10) +3(11) + 1(5)+ 0(4) +2(1) =74 = 74 

Total=153 

On the basis of figure 69 reversed (even letters as 0,’s, odd letters as 0 2 ’s) : 

1 (3) +3(11)+ 3(3) + 1(8) +0(11) +2(6) =65 

65——= 54 
6 

2(4) +3(10) +0(11) +2(5)+ 2(4)+3(l)=59 = 59 

Total=113 

Since the best values are obtained on the basis of figure 69 normal, the type of alternation for 
the third section of 11 letters is 0j-*0j— >0,, or “ + ”. 





I 

f 

[ 

I 





m 

k. Now if columns 1 and 2 contain 11 letters, and the total number of letters is 186, the 
transposition rectangle obviously has 17 columns, there being 16 long columns of 11 letters and 
one short column of 10 letters [(17X11) — 1==186]. 

l. There is another cryptogram which also contains but one short column, viz, VII, of 254 
letters [17X15) — 1=254]. The columns of thi s cryptogram contain 4 more letters than the 
corresponding columns of III and XI. Assuining, momentarily, that the last column is the short 
one, cryptogram VII may be added to the superposition of III and XI, provided these sets of 4 
additional letters are accounted for. This has been done in figure 72. In that figure the 4 
extra letters pertaining to cryptogram VII are shown as falling under the last letters of the col- 
umns of cryptograms III and XI, but this is only an arbitrary placement. It is sufficient to 
place these extra letters in such positions as will make the first one of the series begin in an even 
position. 

m. Since the transposition rectangle is now known to be 17 columns wide, the data in figure 
69 may be enlarged to correspond to this information. For example, whereas in originally 
constructing figure 69 the first column of cryptogram I was assumed to have only 8 letters (to 
correspond to a key of 25 numbers), it may now be extended to a column of 12 letters, and so on. 
.Tire additional portions used to make the distributions in figure .74 are shown underlined in 
figure 73. 
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Figure 72.— Continued. 



Cryptogram Length 




Letters taken 



VDDGCGVF DFVD 

VDAAVD 

DAGAAFGAGV 

ADXVFX 

DFXFDDWVDX 

GDGFXAG 



Cryptogram Length 



Letters taken 

GAFGFFXFV FGFXA 

DGWGFXG 

GDDDDXVGVD 

DGDDFVF 

VFDDVAXGDA 

XFDFXWDVDAVD 



The new frequency weights are therefore as follows: 
Odd (1st, 3d, . . . ) letters 
A D F G V X 



Even (2d, 4th, . . . ) letters 
A D F G V X 

g ^ ^ * 



Total - 4 + 14 + 5 + 11 + 15 + 10 = 59 



Total = 9+15+14+3 + 7 + 2 



Figure 74. 



Since the two totals are quite close together, no correction need be made of the nature of that 
made in preceding calculations, where one-sixth was deducted from the total values of odd letters. 

n. Beginning with position 23, in the case of cryptograms III and XI, the next 11 letters, 
and, in the case of cryptogram VII, the next 15 letters are clearly of the type of alterna- 
tion. The data are as follows: 

, 23 24 25 20 27 28 29 30 31 3? 33 

III. VXGFXFDXDDA 
XI. XDAFDDXGGAV 
VII. VDVFFADAVAV 








Kill 



Distribution of odd letters 

A D F G V X 



Distribution of even letters 

A D F G V X 



/- 2 4 1 3 7 3 



/- 4 4 5 2 0 2 



Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as 0,’s, even letters as 0 2 ’s): 

2(4) +4(14)+ 1(5) +3(11) +7(15) +3(10) =237 
4(9) +4(15) +5(14)+ 2(8)+ 0(7)+ 2(2) = 186 

TotaI=423 

On the basis of figifre 74 reversed (even letters as 0/s, odd letters as 0Ys): 

4(4) +4(14) + 5(5) +2(11) +0(15)+2(10) = 139 
2(9) +4(15) + 1(14)+ 3(8)+ 7(7)+ 3(2) = 171 

Total=310 

Since the greatest total is obtained on the basis of figure 74 normal, the type of alternation for the 
third section of letters is 0,— > 0 2 -> 0 ,, or “ + ”. 

o. Continuing the foregoing process with the letters beyond position 33, the data are as 
follows: 



34 35 36 37 



40 41 42 43 44 



III. GADDGVADDVD 
XI. GAGDVDFDFDD 
VII. ADAAFVFDVFD 

X F X X 



Distribution of odd letters 

A D F G V X 



Distribution of even letters 

A D ;F G V X 



/=■ 3 8 1 0 3 2 



Weighted values of distributions: 



/= 3 8 8 4 2 1 



On the basis of figure 74 normal (odd letters as 0/s, even letters as 0/s): 

3(4) +8(14)+ 1(5) +0(11) +3(15) +2(10) = 194 
3(9) +5(15) +5(14)+ 4(8)+ 2(7)+ 1(2)=220 

Total =4 14 

On the basis of figure 74 reversed (even letters as 0/s, odd letters as 0/s): 

3(4) +5(14)+ 5(5) +4(11) +2(15) + 1(10) = 191 
3 (9) +8(15) + 1(14)+ 0(8)+ 3(7)+ 2(2) = 186 

Total=377 
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Since the distribution begins here with an even-numbered position (34), and the greatest total is 
obtained on the basis of figure 74 normal, hence the alternation for the fourth section or col umn 
is of the type 0 2 -» 0 t -> 0 3 , or 

p. (1) The data for the letters beyond position 44 are as follows: 

45 46 47 46 49 50 51 52 53 54 55 

III. DGAFGAVGDGX 
XI. DGAFAFDAAAG 
VII. GDXDDFVDFFX 

D V F X 

Distribution of odd letters Distribution of even letters 

ADFGVX ADFGVX 




4 5 1 3 3 4 /=> 346400 *-' 

Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as 0/s, even letters as 0 2 ’s): 

4(4) + 5(14)+ 1(5) +3(11) +3(15) +4(10) =209 
3(9) +4(15) +6(14)+ 4(8)+ 0(7)+ 0(2) =203 

Total =412 

On the basis of figure 74 reversed (even letters as 0/8, odd letters as 8/s) : 

3(4) +4(14)+ 6(5) +4(11) +0(15) +0(10) = 142 
4(9) +5(15) + 1(14)+ 3(8)+ 3(7)+ 4(2) = 178 

Total =320 



Since the distribution starts with an odd position (45) and the greatest total is obtained on the 
basis of figure 74 normal, the type of alternation for the fifth section or column is 0 l — » 0 a — > 0,, 
or “ +”. 

q. The types of alternation for the first 5 columns, which are all long columns, is there- 
fore + + H K Since cryptograms III and XI contain but one short column, it is advisable 

to be on the lookout for it as the work progresses. It is possible to continue with the process 
detailed above. For example, the calculations for the next or sixth section of 11 letters are 
shown below: 

66 67 58 69 60 61 62 63 64 65 66 

III. DDDAVFVDDFD 
XI. VAVFGGVADDG 
VII. VADXVAXDVXA 

F F V D 



Distribution of odd letters 

A D F G V X 
1 2 



Distribution of even letters 

ADFGVX 




f- 1 7 1 2 8 1 
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Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as 0/s, even letters as 0 2 ’s): 

5(4) +4(14) + 4(5) + 1 (1 1) + 1 (15) +2(10) = 142 
1 (9) + 7(15) + 1 (14) + 2(8)+ 8(7) + 1(2) =202 

Total =344 

On the basis of figure 74 reversed (even letters as 0,’s, odd letters as 0 2 ’s): 

1(4) +7(14)+ 1(5) +2(11) + 8(15) + 1(10) =259 
5(9) +4(15) +4(14) + 1(8)+ 1(7)+ 2(2) = 180 

Total =439 

Since the distribution starts with an even position (56) and the greatest total is obtained on the 

basis of figure 74 reversed, the type of alternation for the sixth section or column is 0i->0 2 ->0, 
or “ +”. 1 ^ 1 , 

r. But perhaps advantage should be taken of the availability of additional cryptograms. 
For example, cryptogram V, of 202 letters, has 2 short columns [(17X12)— 2=202], whereas the 
cryptograms thus far dealt with each have but one. That is, cryptogram V has one short column 
in common with cryptograms III, XI, and VII, and one additional short column not possessed 
by the latter. Can this additional short column of cryptogram V be located? 

s. Suppose column 1 of cryptogram V is the additional short column. Then the letters of 
column 2 would beFXFXFFFV AGFD. These letters when evaluated on the 
basis of figure 74 normal yield a total of 77 ; when weighted on the basis of figure 74 reversed, 
a total of 144. The calculation is as follows: 

Distribution of odd letters Distribution of even letters 

A D F G V X A D F G V X 

/= 1 0 5 0 0 0 /" 0 11112 

On the basis of figure 74 normal (odd letters as 0/s, even letters as 0 2 ’s): 

1(4) +0(14)+ 5(5) + 0(11) + 0(15) +0(10) =29 
0(9)+ 1(16)+ 1(14)+ 1(8) + 1(7)+ 2(2) =48 

Total=77 



On the basis of figure 74 reversed (even letters as 0/s, odd letters as 0 2 ’s): 

1(9) +0(15) + 5(14)+ 0(8)+ 0(7)+ 0(2) = 79 
0(4) + 1(14)+ 1(5) + 1(11) + 1(15) +2(10) =65 

Total=144 

According to this calculation, column 2 of cryptogram V seems to correspond to the type of 
alternation 0 2 — »0i— »0 2 , that is But from previous work it is fairly certain that column 2 

is of the “+” type. Hence, column 1 of cryptogram V is probably not the additional short 
column of that message. Assuming column 2 to be the extra short column, no such contra- 
diction is obtained, for the calculation is as follows: 
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Assuming column 2 to be short, the letters of column 3 are XAVDAGFDVDGF. 

Distribution of odd letters Distribution of even letters 

A D F G V X A D F G V X 

/= 10 112 1 /■> 13 110 0 

Weighted values of distributions: 

On the basis of figure 74 normal (odd letters as 0/s, even letters as 0/s): 

1(4) +0(14) + 1(5) + 1(11) +2 (15) +1(10) =60 

1(9)+ 3(15) + 1(14)+ 1(8) +90(7) +0(2) =_76 

Total=136 

On the basis of figures 74 reversed (even letters as 0/s, odd letters as 0/2): 

1(9) +0(15) + 1(14)+ 1(8)+ 2(7) + 1 (2)= 47 
1(4)+3(14)+ 1 (5) + 1(11) +0(15) +0(10) = _62 

Total =109 

Since the greatest total is obtained on the basis of figure 74 normal, the type of alternation is 

0 1 -^0 2 ->0 1 and column 3 is a “+” column, which is consistent with the formula + + H f for 

columns 1 to 5, as previously ascertained. 

If all the foregoing reasoning is correct, and column 2 is the additional short column for crypto- 
gram V, it must be the next to the last column of the transposition rectangle. Since it is a 
“+” col umn , the last column must be a “ one; therefore, there are 9 ” columns and 

8 “ + ” columns. This definitely determines that the “ — ” columns are the odd ones, the “ + ” 
columns the even ones, since in an odd-width rectangle there is one more odd column than even 
col umns . 

t. The single short column which is common to cryptograms III, XI, and VII is one of the 
columns beyond column 5. Assuming each possibility in turn, there is obtained for the type of 
alternation in each column the distributions of “ + ” and “ — ” shown in figure 75. 
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Figcrk 75 , 

u. The correct assumption must satisfy the following conditions: 

(a) There must be 9 “ — ” and 8 “ +” columns. 

(b) The short column must be “ — 

324156 — 41 — —10 
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Only assumptions (3) and (5), in which column 8 and column 10 are short columns, satisfy these 
conditions. Therefore, column 2 is followed by either column 8 or 10. Testing the combination 
2-8 for monoalphabeticity of bipartite pairs, the distribution shown in figure 76 is obtained. 
When combination 2-10 is tested, the distribution shown in figure 77 is obtained. Obviously, 
the 2-8 combination is the better. 



2d component 

A D F G V X 




2d component 

A D F G V X 




E (*) = . 0667X17X16= 18. 14 
0 = 22 

Floras 76. 



E (0) = . 0667X17X16= 18. 14 
0=4 

Floras 77. 



v. It is possible by introducing cryptograms with additional short columns to determine 

more of the key. Thus, it was found by using cryptograms XII and VI that the first 3 numbers 
of the transposition key are 16-5-7. But the process of anagramming will yield the solution at 
least as rapidly. In this process, of course, advantage may be taken of the fact that the columns 
have been classified into the and “ — ” types and no combinations of two or two 
“ — ” columns need be tested, since only combinations of the type" -\ ” or“ are permissible. 

w. The final transposition key and the substitution checkerboard are shown in figure 78. 



16 6 7 6 9 3 14 1 13 11 17 10 4 12 
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Figubb 78. 



15 2 8 

TEL 



x. All the foregoing details concern a case in which the transposition rectangle has an odd 
number of columns. Now if the rectangle contains an even number of columns, this type of 
solution is, of course, still applicable, and in fact is easier, since the letters of the text of the re- 
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spective sections do not have to be distributed into odd and even letters. It is only necessary 
to identify a section as being composed of initial components or of final components. This 
analysis then produces a series of sections corresponding in number with the number of columns 
in the transposition rectangle. This number will, of course, be even. By a careful study of 
where alternations in composition of components (0i or © 2 ) occur, the division of the text into 
sections corresponding to long and short columns can be accomplished. The remaining steps 
are obvious and follow the lines elucidated in paragraph 39 e-j. 

y. The entire structure upon which this general solution rests is destroyed if the substitution 
checkerboaid has been consciously manipulated to equalize or flatten out the sums of the weighted 
frequencies of the letters in its rows and columns. For example, note the following checkerboard, 
which is not “perfect” but gives approximately similar frequencies in its rows and col umns 8 

2d component 
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Figure 79. 



z. If the statistical calculations upon which this general solution is based make use of the 
logarithms of the frequencies instead of the frequencies themselves, much more accurate and 
clear-cut data will be obtained. 



1 The frequencies indicated as those given in fig. 3, p. 13, Military Cryptanalysit, Part I. 








Section X 

SOLUTION OF BIFID FRACTIONATING SYSTEMS 



Paragraph 

Review of principles underlying the cryptographic method. - - 44 

Example of a simple bifid cipher _ - - 45 

Principles of solution 46 

Example of solution - 47 

Special solution - - 48 

Periodic bifid ciphers - — 49 

General principles underlying the solution 50 

Ascertaining the length of the period - 51 

Illustration of solution - 52 

Special solutions for bifid systems— - 53 

Solution of trifid systems - - — - 54 

Concluding remarks on fractionating systems. — - - 55 

Concluding remarks on transposition systems - 56 



44. Review of principles underlying the cryptographic method. — Several bifid fractionating 

systems have been explained in previous texts of this series. 1 In certain of these systems four 
basic steps are involved, two of substitution and two of transposition. These steps may be 
briefly described as follows: (1) A process of decomposition (substitution), in which each plain- 
text letter is replaced by two components, Gj and 0?, of a bifid or bipartite alphabet; (2) a 
process of separation (transposition), in which the 9*00 components originally paired together 
are separated; (3) a process of recombination (transposition), in which the separated compo- 
nents are combined to form new pairs; (4) a process of recomposition (substitution), in which 
each new pair of components is given a letter value according to the original or a different bifid 
alphabet. — 

45. Example of a simple bifid cipher. — a. One of the simplest bifid fractionating systems 
is that exemplified in the following subparagraphs. It will be employed to set forth certain 
principles in the general solution of systems of this and similar nature. 

b. Given the 25-cell substitution checkerboard shown in figure 80, let the message to be 
enciphered be ONE PLANE REPORTED LOST AT SEA . The first step is to replace the plain- 
text letters by the bipartite equivalents, the two dements or components being set down ver- 
tically beneath the plain-text letters. This represents the first two of the four processes re- 
ferred to in paragraph 44, the first being that of decomposition or substitution, the second, that 
of separation or transposition, represented by the manner in which the two bipartite elements 
are set down vertically (instead of horizontally), thus separating the two elements from their 
normal horizontal juxtaposition. 

1 See Special Text No. 166, Advanced Military Cryptography, sec. XI and Military Cryptanalysis , Part I, 
sec. IX. 
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3d component 

1 2 3 4 5 
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Fionas 80. 



Plain text 0 NE PLANE REPORTED LOST AT SEA 

Components.! 4 13 44113 23443333 4 4 4 3 1 3 4 s 1 

(2 3 3 31333 38323333 1383 32 332 



The third process, that of recombination or recomposition, also involving a transposition, is now 
to be performed and will consist in combining elements standing in diagonal relationship to the 
right, that is, as shown by the arrows below: 



ONE PLANE REPORTED LOST AT SEA 

413 44113 23442333 4442 12 431 

J* S' S' S' S S 

233 31233 33323232 1262 22 832 

giving the pairs 21, 33, 34, 34, 11, 21, 33, etc. There are left, at the end of the process, one 
element in the upper line at the extreme left and another element in the lower line at the extreme 
right, yielding the pair 24, which may be placed at the head or tail of the resultant combinations, 
as preagreed. The last or fourth process, that of recomposition or substitution, is to replace the 
new pairs of components by letters from the original or a new checkerboard. If the same 
checkerboard is used, it yields the text shown herewith: 



Plain 0 NE PLANE REPORTED LOST AT SEA 

3 23442233 4442 12 43 1(4) 

3 33323232 1282 22 632 

Cipher C EH HMCED EHHTDREI UIWC TI XBI 



Components. .1% ^ % 1 /> 1 /l 

(2 3 3 3 1 2 3 



c. Another and perhaps more simple way of accomplishing the same process is to set down 
the bipartite equivalents horizontally and recombine them as shown below: 



ONEPLANE 

42 13 33 43 41 12 13 33 

\S \S \S \S' \S \S \S \S 

C E H H M C E 

The results are identical with those obtained from the preceding manner of operation. The 
text is of course sent in 5-letter groups. 

d. Instead of using the digits 1, 2, 3, 4, 5, as the bipartite components one can use the 
vowels A, E, I, 0, U, or any other characters that are deemed suitable. Perhaps digits are best 
as they are less likely to be confused with letters of the text. 

e. As intimated above, the checkerboard used for the recomposition may be different from 
that employed in the decomposition. But it will be shown that the additional safety afforded 
by using two different checkerboards is somewhat illusory, and is by no means as great as may 
appear on first consideration. 
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46. Principles of solution. — a. Note 
checkerboard shown in figure 80: 


the following skeleton 


encipherments, 


CENO SEND 

2 3 1 4 4 3 1 3 

111 


R E N C 

2 3 12 


H E N A 

3 3 11 


T E_N Y 

2 3 15 


1332 5332 

N B H X B E 

(1) (2) 


3 3 3 1 

E B D 
(3) 


4 3 3 2 

P B B 
(4) 


2 3 3 4 

R B K 
(5) 



using 



the 



These five encipherments have in common a plain-text digraph EN. The five cipher versions, 
however, have only a single letter in common, B. This is, of course, a phenomenon already 
encountered many times by the student and its cause is easily understood by him: The mechanics 
of the system tend to reduce by one character the lengths of the repetitions in the cipher text, 
as compared with their lengths in the plain text, a trigraphic repetition in the plain text mani- 
festing itself as a digraphic repetition in the cipher text, a tetragraphic one becoming a trigraphic, 
and so on. More will later be stated on this phase of the matter. 

b. But now study the individual cipher letter immediately preceding and succeeding the 
cipher letter which these five encipherments have in common. They are as follows: 



Letters preceding B 0 N, X, E, P, R' 

Letters succeeding B c _H, E, D, B, K 



Reference to the checkerboard discloses the very interesting and important fact that the letters 
preceding the cipher repetition (B c ) all come from the same column in the checkerboard , the letters 
succeeding the repetition aU come from the same row in the checkerboard. How this phenomenon 
is brought about is quite simple to see. Take the first of the five examples, that in which 
C E N 0 P produces N B H e . The N c is the result of combining the second component of the 
bipartite equivalent of C p with the first component bipartite equivalent of E p , yielding the com- 
bination 13, which is N. No matter what the other three letters in the plain-text tetragraph 
may be, if the second letter is Ep, the second component bified equivalent of the first letter of 
the cipher trigraph must be a 3. This means that this first letter of the cipher trigraph must 
come from column 3 of the, checkerboard. Exactly which row this letter will come from is deter- 
mined by the identity of the second component of the bifid equivalent of the first letter of the 
plain-text tetragraph. Hence, since the 5 tetragraphs in the example all have the same plain- 
text letter in the second position, the initial letters of the cipher trigraphs all must come from 
the same column of the checkerboard. It is unnecessary to go through the reasoning, which is 
parallel, in the case of the third letters of the cipher trigraphs: these all must come from the 
same row of the checkerboard. 

c. A good understanding of the phenomenon just noted can certainly be employed to 
advantage in solving this and similar types of systems, for it becomes obvious that a careful study 
of the letters immediately preceding and following cipher repetitions should facilitate a reconstruction 
of the checkerboard employed in the substitution .* Indeed, if there were no other phenomena to 
disturb this very simple relationship, solution would be quite easy. All that would be required 
would be to study the prefixes and suffixes to all the A’s, B’s, C’s, ... in the cryptogram, find 
the letters which belong in the same columns and rows of the checkerboard, and the reconstruc- 
tion of the latter would follow very simply. Unfortunately, however, there is a disturbing 
phenomenon which must now be considered. 

* The principle involved in such reconstruction was, to my knowledge, first pointed out and successfully 
employed early in 1938 by Associate Cryptanalysts S. Kullback and A. Sinkov. 
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d. Note the following encipherments: 



Plain. 



Cipher. 



L P U 

41 43 14 

U B 

(6) 



R 

23 



0 

42 



R 

23 



M 

n 



I 

24 



T B A 
(7) 



Here the B c is preceded by letters (U and T) which not only are not in the same column as those 
in the corresponding position in the case of the first five encipherments, but also these two letters 
are themselves in different columns. The cause of this is not difficult to see. It is merely that 
the second component of the P D and the second component of the R p happen to be identical, the 
first component of the U p and the first component of the M p also happen to be identical, thus 
producing the same cipher letter in both cases. This is a phenomenon which must happen by 
chance a certain number of times, a number which is dependent not only upon the mechanics 
of the system but also upon the exact composition of the checkerboard. Disregarding for the 
moment the latter factor, it is obvious that if the checkerboard is perfectly balanced, the bifid 
element 3, for example, should occur 20 percent of the time as the first or as the second element 
of a bifid pair, since there are 5 elements and each can theoretically appear an equal number of 
times. However, since the checkerboard is not perfectly balanced, the bifid element 5 can, in 
the case of figure 80, appear as a second component of the bipartite equivalent of a cipher lettex 
only very rarely, since it corresponds to the first component of the bifid equivalents of the letters 
V, W, X, Y, and Z, all of which are of low frequency. On the other hand, the bifid element 3, in 
the case of figure 80, can appear very frequently as a first component of the bifid equivalent of 
a cipher letter because it is the second component of the bifid equivalents for the high-frequency 
plain-text letters N, R, and E, which are all in column 3. However, since the exact composition 
of the checkerboard is unknown when cryptograms of this sort are to be solved, frequency 
weights can, of course, not be assigned to any of the components or bipartite elements and it 
will have to be assumed that each one has an equal probability of occurrence, that is, one-fifth. 

e. From the foregoing discussion it is obvious that it would he unwise merely to study the 
prefixes and suffixes to identical single letters of the cipher text in an attempt to solve crypto- 
grams of this sort, for the disturbing effect of the accidental identities of certain cipher letters 
would be sufficient to retard solution. A few detailed examples of the type of study that must 
be made in connection with repetitions in such systems as this will now be given. 

/. It was stated in subparagraph a that the mechanics of the system tend to reduce by one 
character the lengths of the repetitions in the cipher text. The expression “tend to reduce” 
aptly describes the situation, for not only can it happen that a 3-letter repetition in the plain 
text may appear to remain a 3-letter repetition in the cipher text, but also it can happen that 
a 3-letter repetition in the plain text may even appear as a pseudo 4-letter repetition in the 
cipher text. Study the following examples (based on fig. 80) and note what happens in each case: 



(A) 



C B ) 
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is 



H 



34 



33 
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21 
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22 



34 
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(A) 



(B) 
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H 



22 



34 



33 
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32 
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34 



A 

12 



A 

12 



K 



( 1 ) 



( 2 ) 



A 3-letter plain text repetition appears as a 2-letter cipher text repe- A 3-letter plain-text repetition appears as a 3-Ietter cipher-text repe- 
tition. tition because the 1st components of the Dp and H p happen to be identical 

(D and H are in same row in checkerboard) , 
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(4) 











A 3-Ietter plain-text repetition appears as a 3-letter cipher-text repeti- A 3-letter plain-text repetition appears as a 4-letter cipher-text repe- 
tion because the second component of the H p and R p happen to be iden- tition because the phenomena of case 2 and case 3 occur simultaneously 
tical (R and N are in same column in checkerboard). (0 and D are in same column; M and N are in the same row in the checker- 

board). 

g. From a study of these phenomena the rule may be deduced that an n-letter repetition 
in the plain text is really reduced to an (n-l)-letter repetition in the cipher text, but it can happen 
fortuitously * that the real repetition is extended on either or both ends of the repetition by a 
pseudo-repetitious letter. Hence, a 3-letter plain-text repetition may appear as a 2-, 3-, or 
4-letter repetition in the cipher-text. 

h. It is therefore possible to make wholly erroneous deductions from some repetitions, es- 
pecially if the latter are short. Note for instance the following example, still using Fig. 80 
as a basis: 

F 0 U R D A (YS) S 0 M E D U (TY) 

15 42 It 23 32 12 .. . 45 42 11 33 32 14 .. . 

YCODC YCNDC 

Here are 2 sequences of 5 cipher letters, identical save in the central letter, and yet the 6-letter 
plain text sequences have only 2 letters in common. This example is cited to show that the 
cryptanalyst must be very careful in respect to the deductions he may make in the case of short 
repetitions. In the example cited it happens that the accidental repetitions are such as to make 
the sequences as a whole almost appear to be identical. 

i. It is these pseudo-repetitious elements which complicate the solution of what would 
otherwise be a simple system. To illustrate what is meant, note that in case (1) of subparagraph 
f the letters ff c and 0 C , the prefixes to the repetition RP„, do actually come from the same column 
of the checkerboard; the letters D„ and K„, the suffixes, do actually come from the same row. 
But now note in case (2) that while the prefixes D„ and T„ come from the same column, the suf- 
fixes C, and L 0 do not come from the same row. Note also in case (3) tKaf while the"preEx(^ 
L 0 and Ty do not come from the same column, the suffixes, D c and B c , do come from the same row; 
while in case (4) the prefixes turn out to be the same letter, T 0 (which constitutes an Example 
where the two prefixes come from the same column) but the suffixes, M c and E c , come from differ- 
ent rows. Since the exact length of the real repetition, without its pseudo-repetitious elements, 
does not readily manifest itself in the cipher text (although in favorable cases it may be deduced 
by a careful detailed analysis and comparison with nearly similar repetitions) the nature of the 
difficulties confronting the cryptanalyst become apparent. 

j. The nature of the detailed analysis and comparison of repetitions referred to above may 
require a few words of explanation. Suppose that a cryptogram shows many occurrences of 
RP, (=THE P in the foregoing examples). It would indicate a high-frequency plain-text trigraph. 
A few repetitions of such cipher trigraphs as RPE„, DRP e , TRPB 0 , would lead to the surmise that 
the latter are of the type where pseudo-repetitious elements have crept into the picture and there- 

* Strictly speaking, of course, not really fortuitously. It depends upon the exact letters which precede or 
■follow the plain-text repetition and the exact positions these letters occupy in the checkerboard. 
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fore the cryptanalyst should be very hesitant to assume that the adventitious prefixed letters 
are in the same columns, or that the adventitious suffixed letters are in the same row. In fact, 
he would be warranted in tentatively assuming the very opposite condition, that they are not 
in the same columns or rows, respectively. The conclusions derivable from a study of short 
repetitions can be carried over to the longer ones. Note the following four cases from which 
Several conclusions may be reached: 

mURP'OSITIONSA 

' ' 14 23 43 42 45 24 22 24 42 13 45 12 

0 H H I W 0 T Q C H V 

/•ovl S P 0 S I T I 0 N O F 

' ' 24 42 43 42 45 24 22 24 42 13 42 15 

Q Y H I ff 0 T Q C H C 

m HEPOSITIONDE 

' ' 34 33 43 42 45 24 22 24 42 13 32 33 

P H H I ff 0 T Q C E R 

^ORPOSIT’IONLU 

' ' 42 23 43 42 45 24 22 24 42 13 41 14 

THHIWOTQCHM 



First, the 7-letter cipher sequence HIWOTQCis common to all four cases ; if only the cipher 
text were available, one could conclude that the plain-text repetition consists of 8 letters. Second, 
the letters H and Y probably come from the same column in the checkerboard, but as for 0, P, 
and T, they may or may not come from the same column, most probably not. (Actually, 0 and 
T do, but P does not come from the same column as these 2 letters.) Third, the letters H and E 
probably come from the same row in the checkerboard, but as for V, C, and M, they may or may 
not come from the same row, most probably not. (Actually, all 3 letters come from different 
rows.) 

k. Note the following cases of encipherment: The fact that the 7-letter cipher sequence is 
common to all four cases means that the plain-text repetition consists of 8 letters. 
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The pseudo-repetitious letters, I in the third position in cases (1) and (2), and the letters 
Y c and U 0 in corresponding positions in cases (3) and (4) mean that I, U, and Y, come from the 
same column of the checkerboard. The I 0 in position 2, in cases (1), (3), and (4) and the D„ 
in the corresponding position in case (2) indicates that I„ and D e are probably in different columns 
in the checkerboard. In position 11, the H c , B c , and D c give indications of being in the same 
row of the checkerboard. In position 14, W„ and Y c likewise give indications of coming from the 
same row. But note now that from position 12 it may be deduced that ff, A, and T come from 
the same column of the checkerboard. These are examples of the type of detailed analysis 
that the student should follow in his attempt to solve a problem of this sort. 

l. In general it may be said that when the repetitions are numerous and fairly lengthy, that 
is when there is a good deal of traffic all in the same checkerboard, and repetitions of tetragraphs 
and better are plentiful, solution should be relatively easy. In fact, with a fairly large amount 
of traffic, most of the work involved would consist in listing the 2, 3, 4 . . . letter repetitions. 
Then a chart would be drawn up to show the associations which the prefixes make among them- 
selves and the associations which the suffixes make among themselves. For example: 

X A B Q 
NABR 
. Z A B T 
N A B Q 
LABI 
Z A_B T 

Here it is noted that L, N, X, and Z appear as prefixes to repetitions. The letter X is “found in 
company” with N twice; the “association value” of X and N is 2 units. The association value of 
Z and N is, however, 4 units, for the N occurs twice and so does the Z. The association value of 
LX or LZ is 1 unit; that of LN or LZ, 2 units. Thus, the association value for each combination 
can be studied in all the repetitions and, of course, when the value is high for a given combina- 
tion it indicates that the two letters really belong together, or in the same column of the checker- 
board. 

m. What can be done with but one or two relatively short cryptograms depends largely 
upon their lengths, the number of repetitions they happen to have, the exact construction of 
the checkerboard, and the ingenuity and patience of the cryptanalyst. Once the letters that 
constitute the columns and the rows of the checkerboard employed in the recomposition are 
known, the proper assembling of the columns and rows is a relatively simple matter. If a key- 
word has %een used as the basis for the distribution or mixing of the letters, naturally the recon- 
struction of the checkerboard is much facilitated. If not, then either the original or an equiv- 
alent checkerboard may be reconstructed. Having the recomposition checkerboard at hand, 
the determination as to whether it is the same as that used in the decomposition follows directly. 
If not the same, the reconstruction of the decomposition checkerboard is a relatively simple 
matter. 



1 2 3 4 6 3 7 8 6 10 11 12 13 14 18 16 17 18 1ft 20 21 72 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 

EWVRVSDDTW 21 

DWVRVSDDTI 2B 

RWVRVSDDTNULQDUB IB 

GUHKIRXYIRNGTIWAUUIAAQCWN ID 

PWVRVSDDTNULQDUHKIRXYIRNGTIWAUUIAAQCQDTQ 1L 

XWVRVSDDTNULQDU H K IRXYIRNB 2D 

LKIRXYIRNGTIWAUUIAAQCQDTV II 

KIRNGSTLBDDTI 2F 

NIRNGSTLBBD.il 1G 

TWAUUIAAQD 1H 



LQDTXDWYIWXNINBDRQ 1H 

W S A V I 1A 

QSAVNI IUHQDTXII IE 

TAVNNI ’ IF 

QAVNIIUHQDTXDWYIWXNINBDRW 2G 

LQDTXCWSCIVDTNILVN 2H 

DLQDTXWSCLP IK 

C Q D T Z 1J 

NILVNODNULQDUBG 21 

RWVRVSDDTNULQDUBI IB 

XWVRVSDDTNULQDUHK 2E 

LLQDDX 2C 



TVTININDCUWWDC 1C 

WVTININDCUWWDSNI IK 

r % 



D N B A X 1A 

RNBAYIII 2E 

TEWAYIIL 2E 

IEWAYULQ IE 



YIIIGTEIAYI 2E 

BIEWAYU IE 

QVEWCWS II 

ISDCYIWVEWDNB 1A 

BGTEWVR 21 

T X D W Y I W X N I N 1H 



A I N B IB 
KIND 2A 
W A X L 2A 
B A X W 2A 



Figure 81. 



1 2 3 4 6 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 20 27 28 29 30 31 32 33 34 35 36 37 38 39 40 

EWVRVSDDTW 

DWVRVSDDTI 

RWVRVSDDTNULQDUB 

GUHKIRXYIRNGTIWAUUIAAQCWN 
PWVRVSDDTNULQDUHKIRXYIRNGTI WAUUIAAQCQDTQ 
XWVRVSDDTNULQDUHKIRXYIRNB 

LKIRXYIRNGTIWAUUIAAQCQDTV 

KIRNGSTLBDDTI 

NIRNGSTLBDDTW 

TWAUUIAAQD 



21 

2B 

IB 

ID 

1L 

2D 

II 

2F 

1G 

1H 



/Vam n 



1 C1\ 



Figure 82. 
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47. Example of solution. — a. Suppose the two following cryptograms suspected of being in 
the same key are at hand: 



Line 






















No. 1 






















A 


I 


S 


D 


C 


Y 


I 


ff 


V 


E 


W 


D N B 


A X 


ff 


S 


A 


V 


I 


ff 


I 


L 


T K 


B 


X 


L 


Y 


I 


W 


D 


A 


I 


N 


B 


DRW 


V R 


V 


S 


D 


D 


T 


N U 


L 


Q D 


C 


u 


B 


I 


N 


R 


K 


V 


L 


Q 


D 


N L Q 


D T 


V 


T 


I 


N 


I 


N 


D 


C 


U ff 


D 


ff 


D 


C 


V 


S 


0 


D 


C 


G 


S 


I S S 


G U 


H 


K 


I 


R 


X 


Y 


I 


R 


N G 


E 


T 


I 


w 


A 


u 


U 


I 


A 


A 


Q 


C W N 


B I 


E 


ff 


A 


Y 


u 


L Q 


S 


A V 


F 


N 


I 


I 


U 


H 


Q 


D 


T 


X 


w 


I T A 


V N 


N 


I 


N 


D 


c 


U 


ff 


w 


C G 


G 


T 


L 


G 


W 


W 


A 


L 


ff 


D 


s 


N S I 


L N 


N 


I 


R 


N 


G 


S 


T 


L 


B D 


H 


D 


T 


W 


A 


U 


U 


I 


A 


A 


Q 


D G T 


E L 


Q 


D 


T 


X 


D 


ff 


Y 


I 


ff X 


I 


N 


I 


N 


B 


D 


R 


Q 


T 


Q 


V 


E W C 


ff S 


C 


L 


P 


I 


T 


L 


K 


I 


R. X 


J 


Y 


I 


R 


N 


G 


T 


I 


ff 


A 


u 


U I A 


A Q 


C 


Q 


D 


T 


Z 


I 


I 


W 


V T 


K 


I 


N 


I 


N 


D 


C 


U 


ff 


W 


D 


S N I 


L V 


N 


0 


D 


L 


Q 


D 


T 


X 


ff S 


L 


C 


L 


P 


W 


V 


R 


V 


S 


D 


D 


T N U 


L Q 


D 


u 


H 


K 


I 


R 


X 


Y 


I R 


M 


N 


G 


T 


T 


W 


A 


U 


u 


I 


A 


A Q C 


Q D 


T 


V 
















Line 






















No. 2 






















A 


I 


W 


I 


L 


T 


G 


S 


I 


H 


ff 


• W A ff 


K I 


N 


D 


C 


U 


W 


ff 


A 


X 


L X 


B 


D 


I 


W 


I 


R 


C 


V 


N 


0 


D 


N G S 


L N 


G 


I 


G 


ff 


L 


V 


F 


D 


W V 


C 


R 


V 


S 


D 


D 


T 


I 


L 


L 


Q 


D U K 


D ff 


S 


s 


H 


X 


S 


E 


N 


C 


Q D 


D 


T 


Q 


G 


T 


E 


U 


D 


V 


Q 


C 


0 I ff 


T X 


ff 


V 


R 


V 


S 


D 


D 


T 


N U 


E 


L 


Q 


D 


U 


H 


K 


I 


R 


X 


Y 


I R N 


B A 


Y 


I 


I 


I 


G 


T 


E 


ff 


A Y 


F 


I 


I 


L 


W 


N 


K 


I 


R 


N 


G 


STL 


B D 


D 


T 


I 


T 


I 


L 


U 


D 


V L 


G 


V 


T 


T 


A Q 


A 


V 


N 


I 


I 


U H Q 


D T 


X 


D 


ff 


Y 


I 


W 


X 


N 


I N 


H 


B 


D 


R 


W 


S 


C 


L 


P 


L 


W 


A H N 


T L 


Q 


D 


T 


X 


C 


ff S 


C 


I V 


I 


D 


T 


N 


I 


L 


V 


N 


0 


D 


N 


U L Q 


D U 


B 


G 


T 


E 


w 


V R 


V 


S D 



J D T W 

b. A careful and detailed listing of significant repetitions is made, these to show the single- 
letter prefix and suffix in each case. A partial list of the many repetitions present in the two 
cryptograms is given in figure 81. 

c. Consider the first set of repetitions listed in figure 81, as extracted and shown in figure 82. 




According to the principles elucidated in the preceding paragraph, it would seem that the 
following tentative deductions may be made from the data contained in the col umns of figure 82: 

(1) From column 1: E, D, R, P, X belong in the same column of the checkerboard. 

(2) From column 10: W, I, N belong in the same row. 

(3) From column 14: D and G belong in the same column. 

(4) From column 16: B and H belong in the same row. 

(5) From column 16: H and L belong in the same column. 

(6) From column 21: Y, K, N belong in the same column. 

(7) From column 25: G and B belong in the same row. 

(8) From column 27 : X and T belong in the same column. 

(9) From column 33: I and W belong in the same row. 

(10) From column 36: C and D belong in the same row. ' 

(11) From column 37: W and Q belong in the same row. 

(12) From column 40: Q and V belong in the same row. 

It would be most fortunate and unusual for all these tentative deductions to be correct, for the 
disturbing effects of accidental adventitious repetitions have not been taken into account as 
yet. But let an attempt be made to assemble the data deduced thus far, to see if they can all 
be reconciled. 

d. Tentative deduction (1) indicates that E, D„ R, P, and X belong in the same column of 
the recomposition checkerboard. If correct, the complete set of 5 letters of one column is at 
hand. But tentative deduction (3) indicates that D and G belong in the same column and this 
would mean that the column has 6 letters, which is impossible. Further evidence will be re- 
quired to corroborate the hypothesis that E, D, R, P, and X are all actually in the same column, 
or that D and G are actually in the same column. For this purpose, further study must be made,’ 
and it is convenient to compile an “association table” showing how often certain letters are 
associated among themselves as prefixes to the repetitions. A similar association table is made 
for the suffixes. The tables may be combined in a manner similar to that shown in figure 83 
where the prefixes to repetitions appear at the left of the central alphabet, the suffixes to the 
right. 

Take column 1 of figure 82, having D, E, P, R, and X as prefixes to a long repetition. A stroke 
is placed m the E, P, R, and X cells of row D; a stroke is placed in the P, R, and X cells of row E; 
a stroke is placed in the R and X cells of row P; and finally a stroke is placed in the X cell of row r' 
Again, take column 16 of figure 82, reading B H H H L. The B need not be considered, since it is 
not a prefix to the repetition beginning K I R X Y . . ., but the H and L may be considered. 
In the L cell of row H three strokes are inserted to indicate that H and L are associated that 
many times. Each time a datum is obtained, it is added to this table. Figure 83 shows the 
appearance of the table after all the data obtainable from the repetitions listed in subparagraph b 
have been inserted. From even this small amount of material a few deductions can be made. 
For example, it is seen that the B line of the table for prefixes shows 5 strokes at G and 3 strokes 
at ff from which it would appear that B, G, and W may be in the same column. The letters 
C and L likewise seem to be in the same column, as do H and L, making C, H, and L appear to 
be m the same column. Studying the table of suffixes, it would appear that B and H are in the 
same row; I and N are in a row. After the entire text has been examined and the prefixes and 
suffixes distributed in this way, the whole table is studied carefully with a view to eliminating 
the effects of the accidental or pseudo-repetitious letters, trying to locate those letters which 
represent the prefixes and suffixes of true repetitions. 
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PREFIXES 

(Letters in same column) 



SUFFIXES 
(Letters in same row) 




ABCDEFGHIKLMNOPQRSTUVWXYZ ABCDEFGHIKLMNQPQRSTUVWXYZ 

Fwus* 83. 
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e. Suppose the data have been reduced to the following: 



Letters belonging to same columns Letters belonging In same rows 



(1) 


D. 


G. 


u 


(1) 


G, 


B, 


H, 


K 


(2) 


H, 


L, 


c 


(2) 


I, 


w. 


N, 


L 


(3) 


Y, 


K. 


N 


(3) 


D, 


c. 


A, 


S 


(4) 


w. 


Q. 


S, T, B 


(4) 


Q, 


V, 


X, 


Y, Z 










(5) 


T, 


U 







The presumption that Q, V, X, Y, and Z are all in the same row leads to the assumption that 
the mixing of the checkerboard is based upon a key word or key phrase. Following up this 
hypothesis, the data are assembled in the following manner: 

2d component 



1 2 3 4 5 



W 


I 


L 


N 




T 


u 








S 


D 


C 


A 




B 


G 


H 


K 




Q 


V 


X 


Y 


Z 



Floras 84. 



j. Only 6 letters remain to be placed in the checkerboard. But there are enough letters 
already placed to warrant an immediate attempt at decipherment. For example, take the 
first few groups of message No. 2 and replace the letters by their bipartite equivalents: 

IWILTGSIHWWAWKIND 

12 11 12 13 21 42 31 12 43 11 11 34 11 44 12 14 32 

Recombining the bifid elements: 

.1 21 11 21 32 14 23 11 24 31 11 13 41 14 41 21 43 2 . 

Substituting by means of figure 84 : 

.1 21 11 21 32 14 23 11 24 31 11 13 41 14 41 21 43 2 . 

. TWTDN?W?SWLBNBTH . 

Obviously the decomposition and recomposition checkerboards are different. But the recon- 
struction of the former is not at all difficult, since the text is now in monoalphabetic form. The 
message begins with a group showing a repeated letter in the first and third positions: is the 
1st word ENEMY? Probably it is, for message No. 1 also contains the sequence WILT. 
At any rate, a transcription of the cryptograms into the bifid equivalents given by the nearly 
complete recomposition checkerboard (fig. 84) soon yields sufficient monoalphabetic text to 
permit of the complete reconstruction of both checkerboards: 




2d component 

1 2 3 4 5 
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2d component 

1 2 3 4 5 



N 


U 


T 


Y 


P 


E 


0 


I 


F 


L 


A 


M 


B 


C 


S 


R 


W 


G 


D 


H 


K 


Q 


V 


X 


Z 



A 

(Decomposition) 



Fiouke 86. 



W 


I 


L 


N 


0 


T 


U 


R 


E 


M 


S 


D 


C 


A 


F 


B 


G 


H 


K 


P 


Q 


V 


X 


Y 


Z 



B 

(Recomposition) 



g. Speculating upon the key words used to produce the mix ed sequences in these checker- 
boards, the trade-name N U T Y P E (a typewriter cleaning fluid) suggests looking at the 
label on the box containing a bottle of this chemical. It reads: NUTYPE NON- 
INFLAMMABLE TYPE CLEANSER, prepared by WALTER 
G. G I E S. This yields the sequence for the decomposition checkerboard. The legend 
on the box also reads: WILL NOT INJURE MOST DELICATE 

FABRICS AND FURNITURE, which yields the sequence for the 
recomposition checkerboard. 



•> 
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h. The two cryptograms may now be deciphered directly from the checkerboards. The 
plain-texts are as follows: 

No. 1 

ISDCYIWVEWDNBAXWSAVIWILTK 

12 31 32 33 64 12 11 62 24 11 32 14 41 34 63 11 31 34 62 12 11 12 13 21 44 

IT ISREPORTEDTHATTHEENEMYH 
XLYIIDAINBDRIVRVSDDTNULQD 

53 13 64 12 11 32 34 12 14 41 32 23 11 62 23 62 31 32 32 21 14 22 13 51 32 

ASRETIREDTOAPOSITI ONWESTO 
UBINRKVLQDNLQDTVTININDCUW 

22 41 12 14 23 44 62 13 61 32 14 13 61 32 21 52 21 12 14 12 14 32 33 22 11 

FNEWCHESTERSTOPONEREGIMEN 

WDCVSODCGSISSGUHKIRXYIRNG 

11 32 33 62 31 16 32 33 42 31 12 31 31 42 22 43 44 12 23 53 64 12 23 14 42 

TISINVICINITYOFCROSSROADO 

TIWAUUIAAQCWNBIEWAYULQSAV 

21 12 11 34 22 22 12 34 34 61 33 11 14 41 12 24 11 34 54 22 13 51 31 34 52 

NETWOEIGHTANDNORTHWESTTHE 

NIIUHQDTXWITAVNNINDCUWWCG 

14 12 12 22 43 51 32 21 63 11 12 21 34 52 14 14 12 14 32 33 22 11 11 33 42 

REOFSTOPANOTHERREGIMENTCO 

TLGWWALWDSNSILNNIRNGSTLBD 

21 13 42 11 11 34 13 11 32 31 14 31 12 13 14 14 12 23 14 42 31 21 13 41 32 

NCENTRATINGNEARROAD JUNCTI 
DTWAUUIAAQDGTELQDTXDWYIffX 

32 21 11 34 22 22 12 34 34 51 32 42 21 24 13 51 32 21 63 32 11 64 12 11 63 

ONTWOEIGHTFOURSTOPBEPREPA 

NINBDRQTQVEWCWSCLPITLKIRX 

14 12 14 41 32 23 51 21 51 62 24 11 33 11 31 33 13 45 12 21 13 44 12 23 63 

REDTOSUPPORTATTACKONCROSS 

YIRNGTIWAUUIAAQCQDTZIIWVT 

54 12 23 14 42 21 12 11 34 22 22 12 34 34 51 33 51 32 21 55 12 12 11 52 21 

ROADONETWOEIGHTSTOPKEEPON 

ININDCUWWDSNILVNODLQDTXWS 

12 14 12 14 32 33 22 11 11 32 31 14 12 13 62 14 15 32 13 51 32 21 53 11 31 

EREGIMENTINRESERVESTOPATT 

CLPWVRVSDDTNULQDUHKIRXYIR 

33 13 46 11 52 23 52 31 32 32 21 14 22 13 51 32 22 43 44 12 23 53 54 12 23 

ACKPOSITIONIESTOFCROSSROA 

NGTIWAUUIAAQCQDTV 

14 42 21 12 11 34 22 22 12 34 34 51 33 51 32 21 62 

DONETWOEIGHTSTOP 
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No. 2 

IWILTGSIHWWAWKINDCUWWAXLX 

12 11 la 13 21 42 31 12 43 11 11 34 11 44 12 14 32 33 23 11 11 34 63 13 63 

ENEMYINFANTRYREGIMENTHASB 

DIWIRCVNODNGSLNGIGWLVFDWV 

32 12 11 12 23 33 82 14 16 32 14 42 31 13 14 42 12 42 11 13 62 35 32 11 62 

EENOBSERVEDINADEFENSIVEPO 

RVSDDTILLQDUKDWSSHXSENCQD 

23 82 31 32 32 21 12 13 13 51 32 22 44 32 11 31 31 43 63 31 24 14 33 51 32 

SITIONEASTOFGETTYSBURGSTO 

TQGTEUDVQCOIWTXWVRVSDDTNU 

21 51 42 21 24 22 32 62 61 33 15 12 11 21 53 11 52 23 52 31 32 32 21 14 22 

PYOUWILLTAKEUPAPOSITIONWE 

LQDUHKIRXYIRNBAYIIIGTEWAY 

13 61 32 22 43 44 12 23 63 64 12 23 14 41 34 54 12 12 12 42 21 24 11 34 64 

STOFCROSSROADTHREEFOURTHR 

IILWNKIRNGSTLBDDTITILUDVL 

12 12 13 11 14 44 12 23 14 42 31 21 13 41 32 32 21 12 21 12 13 22 32 52 13 

EEANDROADJUNCTIONONEMILES 

VTTAQAVNIIUHQDTXDWYIWXNIN 

52 21 21 34 51 34 62 14 12 12 22 43 51 32 21 53 32 11 54 12 11 53 14 12 14 

OUTHTHEREOFSTOPBEPREPARED 

BDRWSCLPLWAHNTLQDTXCWSCIV 

41 32 23 11 31 33 13 45 13 11 34 13 24 11 53 51 32 21 53 33 11 31 33 12 82 

TOATTACKATDAWNSTOPBATTALI 

DTNILVNODNULQDUBGTEWVRVSD 

32 21 14 12 13 52 14 16 32 14 22 13 51 32 22 41 42 21 24 11 62 23 62 31 32 

ONRESERVEWESTOFYOURPOSITI 

DTI 

32 21 11 

0 N 

48. Special solution. — a. The preceding example of solution constitutes the general solution 
for this system, since no special conditions are prerequisite to the procedure set forth. An 
interesting solution, however, is that wherein the same message has been cryptographed by two 
different sets of checkerboards. 

A, Suppose, for instance, that in this system two cryptograms of identical lengths and plain 
texts but different cryptographic texts are available for examination. They are superimposed 
and appear as follows: 

No. 1. GCODMGCEGBWILWGMONGBSXOPCNGESFLNI 
No. 2. WILTGSIHWWAWKINDCUWWAXLXDIWIRCVNO 

No. 1. WTMGETLNCGFMDWGXHMGATACTOMSWBLGAI 
No. 2. DNGSLNGIGWLVFDWVRVSDDTILLQDUKDWSS 
No. 1. QPFUAQMSAZPHZGNLMSOWOVXGXHMGATAKN 
No. 2. HXSENCQDTQGTEUDVQCOIWTXWVRVSDDTNU 

No. 1. OMSWCUSHQLSSTMSUWNNEHUASUWNTGELSS 
No. 2. LQDUHKIRXYIRNBAYIIIGTEWAYIILWNKIR 

No. 1 . TMOVCVATAEACOGNLOPHVSVSUNWTWFMSAX 
No. 2 . NGSTLBDDTITILUDVLVTQAQA VNI IUHQDTX 



SECOND COMPONENTS OF CRYPTOGRAM NO. 



FIRST COMPONENTS OF CRYPTOGRAM No. 1 




324155—41 (Face p. 167) 



Fioub* 86. 



6£V69'V'<II 



SECOND COMPONENTS OF CRYPTOGRAM No. 
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No. 1. 


C 


G 


U 


W 


G 


X 


N 


W 


T 


M 


S 


S 


G A 


S 


N 


Y 


S 


G 


S 


P 


D 


G 


F 


M S 


A 


X 


E 


G 


A 


S 


N 


No. 2. 


D 


W 


Y 


I 


W 


X 


N 


I 


N 


B 


D 


R 


W S 


C 


L 


P 


L 


W 


A 


H 


N 


T 


L 


Q D 


T 


X 


C 


W 


S 


C 


I 


No. 1. 


M 


T 


A 


C 


W 


0 


L 


N 


I 


W 


D 


N 


0 M 


S 


W 


K 


P 


H 


U 


A 


X 


H 


M 


G A 


T 


A 


C 










No. 2. 


V 


D 


T 


N 


I 


L 


V 


N 


0 


D 


N 


U 


L Q 


D 


U 


B 


G 


T 


E 


W 


V 


R 


V 


S D 


D 


T 


I 











c. Now consider the first few superimposed letters in these two cryptograms: 

No. 1 GCODMGCEG . . . 

No. 2 WILTGSIHW . . . 



No. 1 GCODMGCEG. . . 

No. 2 WILTGSIHW. . . 



Take the pair of superimposed letters GW. The G is the cipher resultant of the recombination of 
two bipartite numerical components that apply to the recomposition checkerboard. The actual 
identities of these numerical components are not known, but, whatever they be, the first of 
them determines the first half of G c , the second determines the second half of G„. Therefore, for 
cryptanalytic purposes, the actual, but unknown, numerical components may be represented 
by the symbols Gi and G 2 , the former referring to the row coordinate of the recomposition checker- 
board, the latter to the column coordinate. What has been said of the letter G applies also to 
the letter W, the equivalent of G in another checkerboard. It will be found that this manner of 
designating bipartite components by means of subscripts to the letters themselves is a very 
useful method of handling the letters. 

d. Let the first few letters of the two cryptograms be replaced by these same cipher letters 
with their subscripts to indicate components. Thus: 



No. 1 CGCODMGCE 

Components — CjC 2 GiG 2 C, C 2 0j0 2 DjD 2 MjM 2 G[G 2 CiC 2 E 1 E 2 

No. 2 IWILTGSIH 

Components.... I t I 2 WiW 2 I X I 2 LiL 2 TiT 2 GiG 2 SiS 2 Iil 2 



Now from the method of encipherment it is clear that C 2 Gj and I 2 Wj represent the same plain-text 
letter, since both messages are assumed to contain identical plain texts. That is, C 2 Gi of crypto- 
gram No. l = I 2 Wj of cryptogram No. 2. Likewise G 2 Ci=W 2 I 2 ; C 2 0!=I 2 Li; 0 2 D!=L 2 T!; and so on. 

e. Let all the component pairs of the cryptograms be equated in this manner and let these 
pairs be distributed in a table, such as that shown in figure 86. It will be seen in figure 86 that, 
for example, A 2 Ci of cryptogram No. 1=T 2 Ii and T 2 Ni of cryptogram No. 2. This means that 
Ii and Ni must represent the same row coordinate of the recomposition checkerboard for crypto- 
gram No. 2; in other words I and N must be in the same row in that checkerboard. Again, in figure 
86, it is seen that C 2 Gi=G 2 Wi and D 2 Wi, which means that G and D must be in the same column in 
that checkerboard. Again, A 2 Si=W 2 Ai==S 2 Ci; this means that A and C are in the same row, W 
and S, in the same column, in the recomposition checkerboard for cryptogram No. 2. All these 
data in figure 86 are studied with the following results: 

In same row: In same column: 



(1) 


I, 


N, 


L, 


W 


(1) 


(2) 


(3) 


(4) 


(5) 


(2) 


A, 


c. 


s. 


D 


T 


H 


Y 


Q 


U 


(3) 


Q, 


V, 


x. 


Y 


W 


C 


K 


B 


I 


(4) 


B, 


G 






s 


L 






D 



R G 

V 



324155 — 41 11 
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An attempt is now made to bring together these results to reconstruct the recomposition checker- 
board for message No. 2. This yields the following: 

2d Component 



u 


K? 


R 


T 


K? 


I 


•N 


L 


W 


K? 


D 


A 


C 


s 


K? 


G 


K? 


H 


B 


K? 


V 


Y? 


X 


Q 


Y? 



Fiouee 86a. 

Compare this with the recomposition checkerboard shown in figure 85 (B). Enough has been 
shown to illustrate the procedure. If there were just a little more text, probably all 25 letters 
of the checkerboard could be definitely placed. 

/• By making a reciprocal table for equivalencies between component pairs in cryptogram 
No. 2, the data obtained would permit of reconstructing the recomposition checkerboard for 
cryptogram No. 1. Having these checkerboards completely or at least partially reconstructed, 
the reconstruction of the decomposition checkerboards is a relatively easy matter and follows 
the procedure described in paragraph 47/. 

g. The complete solution of the two cryptograms, including the decomposition and recom- 
position matrices, is as follows: 

No. 1 



1 



2d Component 

2 3 4 



1 



2d Component 

2 3 4 



a 

1 



1 


R 


E 


F 


L 


C 


1 


W 


A 


S 


H 


I 


2 


T 


I 


N 


G 


P 


S 2 

<6 


N 


G 


T 


0 


D 


3 


0 


A 


B 


D 


H 


0 

1 3 

u • 

2 4 


C 


B 


E 


F 


K 


4 


K 


M 


Q 


S 


U 


L 


M 


P 


Q 


R 


5 


V 


W 


X 


Y 


Z 


5 


U 


V 


X 


Y 


Z 



(Decomposition) 



B 

(Recomposition) 



GCODMGCEGBWILWGMONGBSXOPCNGESF 

22 31 24 25 42 22 31 33 22 32 11 15 41 11 22 42 24 21 22 32 13 53 24 43 31 21 22 33 13 34 

ENEMYINFANTRYREGIMENTHASBEENOB 

LNIWTMGETLNCGFMDWGXHMGATACTOMS 

41 21 15 11 23 42 22 33 23 41 21 31 22 34 42 25 11 22 53 14 42 22 12 23 12 31 23 24 42 13 

SERVEDINADEFENSIVEPOSITIONEAST 

WBLGAIQPFUAQMSAZPHZGNLMSOWOVXG 

11 32 41 22 12 15 44 43 34 51 12 44 42 13 12 55 43 14 55 22 21 41 42 13 24 11 24 52 53 22 

OFGETTYSBURGSTOPYOUWILLTAKEUPA 

XHMGATAKNOMSWCUSHQLSSTMSUWNNEH 

53 14 42 21 12 23 12 35 21 24 42 13 11 31 61 13 14 44 41 13 13 23 42 13 51 11 21 21 33 14 

POSITIONWESTOFCROSSROADTHREEFO 
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UASUWNTGELSSTMOVCVATAEACOGNLOP 

51 12 13 51 11 21 23 22 33 41 13 13 23 42 24 52 31 52 12 23 12 33 12 31 24 22 21 41 24 43 

URTHREEANDROADJUNCTIONONEMILES 

HVSVSUNWTWFMSAXCGUWGXNWTMSSGAS 

14 52 13 52 13 51 21 11 23 11 34 42 13 12 53 31 22 61 11 22 53 21 11 23 42 13 13 22 12 13 

OUTHTHEREOFSTOPBEPREPAREDTOATT 

NYSGSPDGFMSAXEGASNMTACWOLNIWDN 

21 54 13 22 13 43 25 22 34 42 13 12 53 33 22 12 13 21 42 23 12 31 11 24 41 21 15 11 25 21 

ACKATDAWNSTOPBATTALIONRESERVEW 

OMSIKPHUAXHMGATAC 

24 42 13 11 35 43 14 51 12 53 14 42 22 12 23 12 31 

ESTOFYOURPOSITION 



No. 2 



2d Component 



N U I T Y P 



E 0 




2d Component 



I I L I N I 0 



U R E M 



D C 



B G 



M B C S 



K | Q | V | X | Z 



WILTGSIHWWAWKINDCUWWAXLXDIWIRC 

11 12 13 21 42 31 12 43 11 11 34 11 44 12 14 32 33 22 11 11 34 53 13 63 32 12 11 12 23 33 

ENEMYINFANTRYREGIMENTHASBEENOB 

VNODNGSLNGIGWLVFDWVRVSDDTILLQD 

52 14 15 32 14 42 31 13 14 42 12 42 11 13 52 35 32 11 52 23 52 31 32 32 21 12 13 13 51 32 

SERVEDINADEFENSIVEPOSITIONEAST 

UKDWSSHXSENCQDTQCTEUDVQCOIWTXW 

22 44 32 11 41 31 43 53 31 24 14 33 61 32 21 51 42 21 24 22 32 52 51 33 15 12 11 21 53 11 

OFGETTYSBURGSTOPYOUWILLTAKEUPA 

VRVSDDTNULQDUHKIRXYIRNBAYIIIGT 

52 23 52 31 32 32 21 14 22 13 51 32 22 43 44 12 23 63 54 12 23 14 41 34 54 12 12 12 42 21 

POSITIONWESTOFCROSSROADTHREEFO 

EWAYIILWNKIRNGSTLBDDTITILUDVLV 

24 11 34 54 12 12 13 11 14 44 12 23 14 42 31 21 13 41 32 32 21 12 21 12 13 22 32 52 13 52 

URTHREEANDROADJUNCTIONONEMILES 

TTAQAVNIIUHQDTXDWYIWXNINBDRWSC 

21 21 34 51 34 52 14 12 12 22 43 51 32 21 53 32 11 54 12 11 53 14 12 14 41 32 23 11 31 33 

OUTHTHEREOFSTOPBEPREPAREDTOATT 

LPLWAHNTLQDTXCWSCIVDTNILVNODNU 

13 45 13 11 34 13 24 11 53 51 32 21 53 33 11 31 83 12 52 33 21 14 12 13 52 14 15 33 14 22 

ACKATDAWNSTOPBATTALIONRESERVEW 

LQDUBGTEWVRVSDDTI 

13 51 32 22 41 42 21 24 11 52 23 52 31 32 32 21 11 

ESTOFYOURPOSITION 
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h. It is seen that the principles elucidated permit of solving this fairly good cipher system 
without recourse to frequency studies and detailed, difficult analytical research. What can be 
done with complete messages of identical texts will give the student a clue to what might be done 
when fairly lengthy sequences of identical plain texts (but not complete messages) are available 
for study. Messages with similar beginnings, or similar endings will afford data for such 
reconstruction. 

49. Periodic fractionating systems. — a. Another type of combined substitution-transposition 
system involving fractionation is that in which the processes involved are applied to groupings 
of fixed length, so that the system gives external evidence of periodicity. One such system, 
commonly attributed to the French cryptographer Delastelle, is exemplified below. Let the 
bipartite alphabet be based upon the 25-cell substitution checkerboard shown in figure 80. 
Let the message to be enciphered be ONE PLANE REPORTED LOST AT SEA. Let it also be 
assumed that by preagreement between correspondents, periods of 5 letters will constitute the 
units of encipherment. The bipartite equivalents of the plain-text letters are set down vertically 
below the letters. Thus: 

2 * component 

1 2 3 4 5 



M 


A 


N 


u 


F 


C 


T 


R 


I 


G 


B 


D 


E 


H 


K 


L 


0 


P 


Q 


S 


V 


W 


X 


_L 


Z 



Figure 87. 



0 N E P L 

4 13 4 4 

2 3 3 3 1 



A N E R E 

113 2 3 

2 3 3 3 3 



PORTE 

4 4 2 2 3 
3 2 3 2 3 



U L U S T 

3 4 4 4 2 

2 12 5 



A T SEA 

1 2 4 3 1 

2 2 5 3 2 



Recombinations are effected horizontally within the periods, by joining components in pairs, 
the first period yielding the pairs 41, 34, 42, 33, 31. These pairs are then replaced by letters 
from the original checkerboard, yielding the following: 

ONEPL ANERE PORTE DLOST ATSEA 

4 I 3 4 4 11900 ..oo. ... 



4 13 4 4 

2 3 3 3 1 



113 2 3 
2 3 3 3 3 



4 4 2 2 3 
3 2 3 2 3 



3 4 4 4 2 
2 12 5 2 



1 2 4 3 1 

2 2 5 3 2 



LHOEB MDDEE QTERR HQTAW APAGD 

b. A different checkerboard may, of course, be employed for the recomposition process. 
Also, periods of any convenient length may be employed; or, in a complicated case, periods of 
varying lengths may be employed in the same cryptogram, according to some prearranged key. 

50. General principles underlying the solution.— a. It will be noted that the periods in the 
foregoing example contain an odd number of letters. The result of adopting odd-length periods 
is to impart a much greater degree of cryptographic security to the system than is the case when 
even-length periods are involved. This point is worth while elaborating upon to make its crypt- 

analytic significance perfectly clear. Note what happens when an even period is employed; 

ONEPLA xt tt* r> n* t-» n n m n « a J 



13 4 4 

3 3 3 1 



L H L R E A 



N E R E P 0 

1 3 2 3 4 4 

3 3 3 3 3 2 

N R Q E E D 



R T E D L 0 



2 2 
3 2 



3 3 4 4 

3 2 12 



T E Q D D A 
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Now if each 6-letter cipher group is split in the middle into two sections and the letters are taken 
alternately from each section (Ex. LHLREA=LRHELA) the results are exactly the 
same as would be obtained in case a simple digraphic encipherment were 
to be employed with the 2-square checkerboard shown in figure 88. 

For example, ON p =LR 0 ; EP p =HE cl and so on. Encipherment of this 
sort brings about a fixed relationship between the plain-text digraphs 
and their cipher equivalents, so that the solution of a message of this 
type falls under the category of the cryptanalysis of a case of simple 
digraphic substitution, once the length of the period has been estab- 
lished. 8 The latter step can readily be accomplished, as will be seen 
presently. In brief, then, it may be said that in this system when 
encipherment is based upon even periods the cipher text is purely 
and simply digraphic in character, each plain-text digraph having 
one and only one cipher-text digraph as its equivalent. 

b. But the latter statement is no longer true in the case of odd 
periods. Note, in the example under paragraph 49a, that the cipher 
equivalent of the first plain-text digraph of the first group, ON, is 
composed of the initial and final components of the letter L e , the 
final component of the letter 0 C , and the initial component of the 
letter L c . That is, three different plain-text letters, L, 0, and E, are 
involved in the composition of the cipher equivalent of one plain-text 
digraph, ON. Observe now, in the following examples, that variants 
may be produced for the digraph 0N P . 



M 


A 


N 


U 


F 


C 


T 


R 


I 


G 


B 


D 


E 


H 


K 


L 


0 


P 


Q 


S 


V 


W 


X 


Y 


Z 


M 


C 


B 


L 


V 


A 


T 


D 


0 


W 


N 


R 


E 


a.p 


X 


U 


I 


H 


Q 


Y 


F 


G 


K 


s 


Z 



0 

L 



E P LA 
HE LA 

Figure 88. 



1 2 3 4 5 


1 2 3 4 5 


1 2 3 4 5 


1 2 3 4 S 


1 2 3 4 5 


1 2 3 4 5 


ON EP L 


ON TH E 


ON CR U 


PR ON G 


CO NT I 


P0 NG I 


4 1 3 4 4 


4 1 2 3 3 


4 1 2 2 1 


4 2 4 1 2 


2 4 12 2 


4 4 12 2 


2 3 3 3 1 


2 3 2 4 3 


2 3 13 4 


3 3 2 3 5 


1 2 3 2 4 


3 2 3 5 4 


LH 0E B 


LR DD P 


LT AB H 


0L RD K 


IA CR I 


QA RR Y 


(1) 


(2) 


(3) 


(4) 


(5) 


(6) 



1 2 
AT 

1 2 
2 2 



3 4 
10. 
2 4 

4 2 



AI AI 

(7) 



c. The foregoing examples fall into two classes. In the first, where the 0 of 0N P falls in an 
odd position in the period, the first letter of the trigraphic cipher equivalent must be an L e , the 
second must be one of the 5 letters in the second column of the substitution checkerboard, the 
third must be one of the 5 letters in the third row of the checkerboard. Therefore, L„ may 
combine with 5X5 or 25 pairs of letters to form the second and third letters of the 3-letter equiva- 
lent of 0N P . In the other class, where the 0 of 0N P falls in an even position in the period, the 
first letter of the equivalent must be one of the 5 letters in the fourth column of the checkerboard, 
the second must be one of the 5 letters in the first row, and the third letter must be R 0 . There- 
fore, R„ may combine with 5X5 or 25 pairs of letters to form the first and second letters of the 
3-letter equivalent of 0N P in this position in the period. Hence, 0N P may be represented by 50 
trigraphic combinations; the same is true of all other plain-text digraphs. Now if the system 
based upon even periods is considered as a simple digraphic substitution, the foregoing remarks 
lead to characterizing the system based upon odd periods as a special type of digraphic sub- 
stitution with variants, in which 3 letters represent 2 plain-text letters. 

* An example of the solution of a cryptogram of this type was given in Military Cryptanalysis, Part I, 
sec. IX. 




; ii In) ;; BI o ?$ h 3 '•? 
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d. However, further study of the odd-period system may show that there is no necessity for 
tiying to handle it as a digraphic system with variants, which would be a rather complex affair. 
Perhaps the matter can be simplified. Referring again to the example of encipherment in 
paragraph 49 a: 



0 N E P L 

4 13 4 4 

2 3 3 3 1 



ANERE 

113 2 3 

2 3 3 3 3 



PORTE 

4 4 2 2 3 
3 2 3 2 3 



D L 0 S T 

3 4 4 4 2 

2 12 5 2 



A T S E A 

1 2 4 3 1 

2 2 6 3 2 



LHOEB MDDEE QTERR HQTAW APAGD 

Now suppose that only the cipher letters are at hand, and that the period is known. The first 
cipher letter is L, and it is composed of two numerical bifid components that come from the first 
and second positions in the upper row of components in the period. These components are not 
known, but whatever they are the first of them is the first component of L, the second of them 
is the second component of L. Therefore, just as in paragraph 48c, the actual but unknown, 
numerical components may be represented by the symbols L t and L 2 , the former referring to the 
row coordinate of the substitution checkerboard, the latter to the column coordinate. The 
same thing may be done with the components of the second cipher letter, the third, fourth, and 
fifth, the respective components being placed into their proper positions in the period. Thus: 



Cipher LHOEB 

Components 



L i L 2 H ! H 2 0 i 
0 2 Ei E 2 B i B 2 



Now let the actual plain-text letters be set into position, as shown at the right in the two dia- 
grams below. 



Plain text. 

Components 
Cipher— 



0 N E P L 
[41344 
2 3 3 3 1 

LHOEB 



0 N E P L 
L, L 2 H, H 2 0 , 
0 2 E i E 2 B j B 2 
L H 0 E B” 



By comparing the two diagrams it becomes obvious that Lj, H 2 , and Oj all represent the coordinate 
4; Hi, Ei, E 2 , and Bi all represent the coordinate 3, and so on. If this equivalency were known 
for all the 50 combinations of the 25 letters with subscript 1 or 2 there would be no problem, 
for the text of a cryptogram could be reduced to 25 pairs of digits representing monoalphabetic 
encipherment. But this equivalency is not known in the case of a cryptogram that is to be 
solved; basically the problem is to establish the equivalency. 



e. Ibis obvious that the vertical pair of components ^ represents 0 P , the vertical pair 

Ei 

represents N p , and so on. The complete example therefore becomes: 



Plain 


_0 N E P L 


ANERE 


PORTE 


D L 0 S T 


A T S E A 


Components 


[ L, L 2 Hi H, 0i 


Mi M 2 Di D 2 Di 


Qi Q 2 Ti T 2 Ei 


Hi H 2 Qi Q 2 Ti 


Ai A 2 Pi P 2 Ai 




[ u 2 Ei E 2 Bi Bi 


D 2 til ^2 til ti2 


IS 2 Ri Rj Hi R 2 


T$ Ai A 2 Wi W 2 


A 2 Gi G 2 Di D 2 


Cipher 


LHOEB 


MDDEE 


QTERR 


HQTAW 


APAGD 



/. Note that a plain-text letter in an odd position in the period has its components in the order 
0i9 2 ; in an even position in the period the components of a plain-text letter are in the order 0 2 0i. 



For example, note the 0 P in the first period an< ^ the * n the third period This- 



distinction must be retained since the component indicators for rows and columns are not inter- 
changeable in this system. From this it follows that the vertical pairs of components represent- 



'd 
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ing a given plain-text letter are of two classes: 0!0 2 and 0 2 ©i, and the two must be kept separate 
in cryptanalysis. 



g. Now consider the equivalent of 0 P in the first period. It is composed of This is 

02 

only one of a number of equivalents for 0 P in an odd position in the period. The row of the sub- 
stitution checkerboard indicated by Li may be represented by 4 other components, since that 

0 

row contains 5 letters. Therefore the upper component of the 1 equivalent of 0„ may be any 

0o 



one of 5 letters. The same is true of the lower component. Hence, 0 P in an odd position in the 
period may be represented by any one of 5X5=25 combinations of vertical components in the 
sequence 0 X — >0 2 . 0 P in an even position in the period may be represented by any one of a similar 
number of combinations of vertical components in the reverse sequence, 0 2 ->0 t . Thus, dis- 
regarding the position in the period, this system may be described as a monoalphabetic sub- 
stitution with variants, in which every plain-text letter may be represented by any one of 50 
different component-pairs. But in studying an actual cryptogram in this system, since the 
position (odd or even) occupied by a cipher letter in the period is obvious after the length of the 
period has been established, a proper segregation of the cipher letters will permit of handling the 
cipher letters in the two classes referred to above, in which case one has to deal with only 25 
variants for each plain-text letter. Obviously, the 25 variants are related to one another by 
virtue of their having been produced from a single enciphering matrix of but 25 letters. This 
relationship can be used to good advantage in reconstructing the matrix in the course of the 
solution and the relationship will be discussed in its proper place. 

h. Now if the foregoing encipherment is studied intently several important phenomena may 
be observed. Note, for instance, how many times either the 0i or the 0 2 component coincides 
with the plain-text letter of which it is a part. In the very first period the 0 P has an 0 2 under it; 
in the same period the E p has an E 2 under it. The same phenomenon is observed in columns 
3 and 5 of the second period, in column 3 of the third period, and in column 1 of the fifth period. 
In column 5 of the third, fourth, and fifth periods the 0i components coincide with the respec- 
tive plain-text letters involved. There are, in this short example, 9 cases of this sort, giving 
rise to instances of what seems to be a sort of self-encipherment of plain-text letters. How does 
this come about? And is it an accident that all these cases involve plain-text letters in odd 
positions in the periods? 

i. If the periods in the foregoing example in subparagraph e are studied closely, the following 
observations may be made. Because of the mechanics of encipherment in this system the first 
cipher letter and the first plain-text letter in each period must come from the same row in the 
substitution checkerboard. Since there are only 5 letters in a row in the checkerboard the proba- 
bility that the two letters referred to will be identical is 1/5. (The identity will occur every time 
that the coordinate of the row in which the second plain-text letter stands in the checkerboard is 
the same as the coordinate of the column in which the first plain-text letter stands.) The same 
general remark applies to the second cipher letter and the third plain-text letter; as well as to 
the third cipher letter and the fifth pliain-text letter: In these cases the two letters must come 
from the same row in the checkerboard and the probability that they will be identical is likewise 
1/5. (The identity in the former case will occur every time that the coordinate of the row in 
which the fourth plain-text letter stands in the checkerboard is the same as that of the column 
in which the third plain-text letter stands; in the latter case the identity will occur every time 
that the coordinate of the column in which the first plain-text letter stands is the same as that 
of the column in which the fifth plain-text letter stands.) The last of the foregoing sources of 
identity is exemplified in only 4 of the 9 cases mentioned in subparagraph h above. These 
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involve the fifth plain- text letter in the third, fourth, and fifth periods, and the first letter in the 
fifth period, wherein it will be noted that the 6, component standing directly under the plain- 
text letter is identical with the latter in each case. 

j. But how are the other 5 cases of identity brought about? Analysis along the same 
lines as indicated above will be omitted. It will be sufficient to observe that in each of those 
cases it is the 0 2 component which is identical with the plain-text letter involved, and again the 
probability of the occurrence of the phenomenon in question is 1 /5. 

k. Since the probability of the occurrence of the event in question is 1/5 for 0! components 
and 1/5 for 0 2 components, the total probability from either source of identity is 2/5. This 
probability applies only to the letters occupying odd positions in the period, and it may be said 
that in 40 percent of all cases of letters in odd positions in the periods the one or the other of the 
two cipher components will be identical with the plain-text letter. 

l. As regards the plain-text letters in even positions, analysis will show why only in a very 
few cases will either of the cipher components coincide with the plain-text letter to which they 
apply, for the method of findin g equivalents in the substitution checkerboard is to take the 
first component as the row coordinate indicator and the second component as the column indi- 
cator; a reversal of this order will give wholly different letters, except in those 5 cases in which 
both components are identical. (The letters involved are those which occupy the 5 cells along 
the diagonal from the upper left-hand comer to the lower right-hand comer of the checkerboard.) 
Now in every case of a letter in an odd position in a period the two vertical components are in 
the 0!0 2 order, corresponding to the order in which they are normally taken in finding letter 
equivalents in the checkerboard. But in every case of a letter in an even position in a period, 
the two vertical components are in the order 0 2 ©i, which is a reversal of the normal order. It 
has been seen that in the case of letters in odd positions in the periods the probability that one 
of the components will coincide with the plain-text letter is 40 percent. The reasoning which led 
to this determination in the case of the odd letters is exactly the same as that in the case of letters 
in even positions, except that in the final recomposition process, since the components in the 
even positions arc in the 0 2 0j order, which is the reverse of the normal order, identity between 
one of the components and the plain-text letter can occur in only 1/5 of the 40 = 8 percent of 
the cases. It may be said then that in this system 48 percent of all the letters of the plain text 
will be “self-enciphered” and represented by one or the other of the two components; in the 
case of the letters in odd positions, the amount is 40 percent, in the case of letters in even posi- 
tions, it is 8 percent. 

m. Finally, what of the peculiar phenomenon to be observed in the case of the first column 
of the fifth period of the example in subparagraph el Here is a case wherein the plain-text 
value of a pair of superimposed components is unmistakably indicated directly by the cipher 
components themselves. Studying the cipher group concerned it is noted that it contains 
2 A 0 ’s separated by one letter, that is, the A’s are 2 intervals apart. This situation is as though 
the plain-text letter were entirely self-enciphered in this case. Now it is obvious that this 
phenomenon will occur in the case of periods of 5 letters every time that within a period a cipher 
letter is repeated at an interval of 2, for this will bring about the superimposition of a 0! and 0 2 
with the same principal letter and therefore the plain-text letter is indicated directly. This 
question may be pertinent: How many times may this be expected to happen? Analysis along 
the lines already indicated will soon bring the answer that the phenomenon in question may be 
expected to happen 4 times out of 100 in the case of letters in odd positions and only 8 times out 
of 1,000 in the case of letters in even positions. In the latter cases the letters involved are those 
falling in the diagonal sloping from left to right in the substitution matrix. 
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n. All of the foregoing phenomena will be useful when the solution of an example is under- 
taken. But before coming to such an example it is necessary to explain how to ascertain the 
period of a cryptogram to be solved. 

51. Ascertaining the length of the period. — a. There are several methods available for 
ascertaining the length of the period. The simplest, of course, is to look for repetitions of the 
ordinary sort. If the period is a short one, say 3, 5, 7 letters, and if the message is fairly long, the 
chances are good that a polygraph which occurs several times within the message will fall in 
homologous positions within two different periods and therefore will be identically enciphered 
both times. There will not be many such repetitions, it is true, but factoring the intervals 
between such as do occur will at least give some clue, if it will not actually disclose the length of 
the period. For example, suppose that a 7-letter repetition is found, the two occurrences being 
separated by an interval of 119. The factors of 119 are 7 and 17; the latter is unlikely to be the 
length of the period, the former, quite likely. 

b. If a polygraph is repeated but its two occurrences do not fall in homologous positions in 
two periods, there will still be manifestations of the presence of repetition but the repeated letters 
will be separated by one or more intervals in the periods involved. The number of repeated 
letters will be a function of the length of the polygraph and the length of the period; the interval 
between the letters constituting the repetition will be a function of the length of the period and 
the position of the repeated polygraph in two periods in which the two polygraphs occur. Note 
what happens in the following example : 



S E N D T H R 

4 3 1 3 2 3 2 

5 3 3 2 2 4 3 

PHRGETP 

\ / 



EEMENDO 

3 3 13 13 4 
3 3 1 3 3 2 2 

ENNPBET 

\ / 



W N T 0 E N D 

5 1 2 4 8 1 3 
2 3 2 2 3 3 2 

VIBDDRD 
\ / 

Cryptogram 



0 F E N D I C 

4 13 13 2 2 

2 5 3 3 2 4 1 

L B D T X D L 

“\ / 



0 T T R 0 A D 

4 2 2 2 4 1 3 

2 2 2 3 2 2 2 

0 T L D T D T 



PNRGE TPENN PBETV IBDDR DLBDT XDLOT LDTDT 



Here the plain text contains the trigraph END 4 times. The ENDp in the first period gives rise to 

1 2 3 4 5 6 7 

the cipher letters . N . . E . . ; in the second period this trigraph also produces 

1 2 3 4 5 6 7 

. . N . . E . The interval between the N c and the E„ is 3 in both cases. Two times this 

interval plus one gives the length of the period. In this case the initial letter of the repeated 

trigraph falls in an even position in the period in both occurrences. The END P in the third period 

1 2 3 4 5 6 7 

gives rise to the cipher letters . . B . . . D; in the fourth period it also produces 

1 2 3 4 6 6 7 

. B . . . D . The interval between the B„ and the D c is 4 in both cases. Two times this 

interval minus one gives the length of the period. In this case the initial letter of the repeated 
trigraph falls in an odd position in the period in both occurrences. 

c. The foregoing properties of repetitions in this system afford a means of ascertaining the 
length of the period in an unknown example. First, it is evident that a repeated trigraph in the 
plain text produces two different pairs of cipher equivalents according to whether the initial 
letter of the trigraph occurs in an odd or an even position in the period. The two letters con- 
stituting the repetition in the cryptogram will not be sequent but will be separated by an interval 
of 1, 2, 3, . . . letters depending upon the length of the period. This interval, however, is half 
of the period plus or minus one. 4 Conversely, if in a cryptogram there are repetitions of pairs of 



4 The student must remember that the text is here concerned only with cases in which the period is odd. 
In the case of even periods the interval separating the 2 letters is always exactly half of the length of the period. 



letters separated by an interval x, it is probable that these repetitions represent repetitions of 
plain-text trigraphs which occupy homologous positions in the period. The interval x (between 
the letters constituting the repetition in the cipher text) then gives a good clue to the length of 
the period: ^(length of period) =2z± 1. 

d. A special kind of index is prepared to facilitate the search for repetitions of the nature 
indicated. If tabulating machinery is available, an alphabetically arranged index showing say 
10 succeeding letters after each A,, B„, C„ . . . Z, is prepared for the cryptogram. Then this 
index is studied to see how many coincidences occur at various intervals under each letter. For 
example, under A c one looks to see if there are 2 or more cases in which the same letter appears 
2, 3, 4, . . . intervals to the right of A, a record being kept of the number of such cases under 
each interval. The same thing is done with reference to B„, C„, and so on. The tallies represent- 
ing coincidences may be amalgamated for all the letters A, B, C, . . . Z, only the intervals being 
kept segregated. When tabulating machinery is not available, the search for repetitions may be 
made by transcribing the cryptogram on two long strips of cross-section paper, juxtaposing the 
strips at A, B, C, . . . Z, and noting the coincidences occurring 1, 2, 3, . . . up to say 10 letters 
beyond the juxtaposed letters. For example, beginning with A e , the two strips are juxtaposed 
with the first A on lone against the first A on the other. Note is made of any coincidences found 
within 10 letters beyond the A’s, and a record is kept of such coincidences according to intervals. 
Keeping one strip in position the other is slid along to the second A, and again coincidences are 
sought. All the A’s are treated in this way, then the B’s, C’s . . . Z’s. The record made of the 
coincidences may consist merely of a tally stroke written under the intervals 1, 2, 3, . . . 10. 
That interval which occurs more frequently than all the others is probably the correct one. This 
interval times 2, plus or minus 1 is the length of the period. There are, therefore, only two alter- 
natives. A choice between the two alternatives may then be made by transcribing the text or 
a portion of it according to each hypothesis. That transcription which will most often throw 
the two members constituting a repetition into one and the same period is most likely to be 
correct. 

e. Finally, for ascertaining the period there is one method which is perhaps the most labori- 
ous but surest. It has been pointed out that this system reduces to one that may be described 
as monoalphabetic substitution with variants. If the cipher text is transcribed into 0, and 0 2 
components according to various assumed periods, and then a frequency distribution is made of 
the pairs of vertical components for each hypothesis, that period which gives the best approxi- 
mation to the sort of distribution to be expected for a system of monoalphabetic substitution 
with 25 variants for each letter may be taken to be correct. For in the case of an incorrect period 
the resultant vertical bipartite components are not the equivalents of the actual plain-text 
letters; hence such repetitions as occur are purely accidental and the number of such cases would 
be rather small. But in the case of the correct period the resultant vertical pairs of components 
are the equivalents of the actual plain-text letters; hence repetitions are causal and fairly fre- 
quent. Were it not for variants, of course, the distribution would be perfectly monoalphabetic. 
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52. Illustration of solution. — a. With the foregoing principles in mind, the following cryp- 
togram will be studied: 

KZFBE ILYYM OCBRB LZDOT GBLPK YWCUC CEPQL 

AMEYL ZQXWH LRWQY DRWBM TIZEB ELAYE SOBRY 

QVBBL YXNAB QBDOY MQDLW LNACO XCRRG ASWQB 

FDDTE BAMFD ETENA KGDFO QDUBN DCLYD VWBAX 

CAUGG XOART X XTSD AYXHK OLSXA BRKRP UZWHO 

MTDHT SGMLS LQPOU NHCIC KKAQB DOFLE KAPRG 

SXUPO WALMA VQHLM LAXKP WSTMC XKQVH SIXSL 

L W X L X RSGZD FKLNY BXMRB NADKT TBAEO BHWVL 

YSXMB OWPGX KORZI UCEAD YIDBL ZMITA NHCAI 

DNCID DOYIB CNOLY UUMCE POTDM GBFUN AHLBD 

WXNXK KCSCT 0 XTSD AYXHK CNLDK RRFAY AEMHC 

ANMBV GREZQ ATCYI MNDLR LGMTW ETRCV VKTED 

UFDEL XHEQV CBLYU DUGYA FHNQL KFRUC NVDLH 

L Z D R E L K XKU PSEMC TNKTK EBOEE PGVQT G If E R'H 

L Z D R E L K FAX IYDAKZLXXO RRPER RRRNC IE 

b. The long repetitions noted in the text (intervals=210 and 35) indicate a period of either 
5 or 7. By transcribing several lines of text into their B x and 0 2 components according to both 
of these alternatives and distributing the vertically superimposed pairs, it is soon found that a 
period of 7 produces many more repetitions than does a period of 5. The entire text is then 
transcribed into its 0! and 0 2 components according to a period of 7 (see fig. 89) and complete 
distributions of 0i0 2 and 0 2 0, vertical pairs are made, the distributions being, of course, kept 
separate. They are shown in figures 90 and 91. The individual distributions show many 
repetitions and the distributions as a whole are very favorable for a period of 7. 

I 2 3 4 5 

K Z F B E I L YYMOCBR BLZDOTG B L P K Y W C U C C E P Q L 
Ki K 2 Zi Z 2 Fi F 2 Bj Y, Y 2 Yj Y 2 Mi M 2 0i Bi B 2 Li L 2 Zi Z 2 Di Bi B 2 Li L 2 Pi P 2 Ki Ui U 2 Ci C 2 Ci C 2 Ei 

B 2 Ei E 2 Ii I 2 Li L 2 0 2 Ci C 2 Bi B 2 Ri R 2 D 2 Oi 0 2 Ti T 2 Gi G 2 K 2 Yi Y 2 Wi W 2 Ci C 2 E 2 Pi P 2 Qi Q 2 Li L 2 

6 7 8 9 10 

A M E Y L Z Q XffHLRffQ Y D R W B M T I Z E B E L A Y E S 0 B R Y 

Ai A 2 Mi M 2 Ei E 2 Y] Xi X 2 Wi W 2 Hi H 2 Li Yi Y 2 Di D 2 Ri R 2 Wi Ii I 2 Zi Z 2 Ei E 2 Bi Yi Y 2 Ei E 2 Si S 2 Oi 

Y 2 Li L 2 Zi Z 2 Qi Q 2 L 2 Ri R 2 Wi W 2 Qi Q 2 W 2 Bi B 2 Mi M 2 Ti T 2 B 2 Ei E 2 Li L 2 Ai A 2 0 2 Bi B 2 Ri R 2 Yi Y 2 

II 12 13 14 15 

Q V B B L Y X N A B Q B D 0 Y M Q D L W L N A C 0 X C R R G A S W Q B 

Qi Q 2 Vi V 2 Bi B 2 Bi N, N 2 Ai A 2 Bi B 2 Qi Yi Y s Mi M 2 Qi Q 2 Di Ni N 2 Ai A 2 Ci C 2 Oi Ri R 2 Gi G 2 Ai A 2 Si 

B 2 Li L 2 Yi Y 2 Xi X 2 Q 2 Bi B 2 Di D 2 Oi 0 2 D 2 Li L 2 Wi W 2 Li L 2 0 2 Xi X 2 Ci C 2 Ri R 2 S 2 Wi W 2 Qi Q 2 Bi B 2 

16 17 18 19 20 

F D D T E B A M F D E T E N A K G D F 0 Q D U B N D C L Y D V W B A X 

Fi F 2 Di D 2 Di D 2 Ti Mi M 2 Fi F 2 Di D 2 Ei Ai A 2 Ki K 2 Gi G 2 Di Di D 2 Ui U 2 Bi B 2 Ni Yi Y 2 Di D 2 Vi V 2 Wi 

T 2 Ei E 2 Bi B 2 Ai A 2 E 2 Ti T 2 Ei E 2 Ni N 2 D 2 Fi F 2 Oi 0 2 Qi Q 2 N 2 Di D 2 Ci C 2 Li L 2 W 2 Bi B 2 Ai A 2 Xi X 2 
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c. The text now being transcribed into periods of 7, with the 0! and 0 2 components indicated 
by the cipher letters in each period, the vertical pairs of components are examined to locate 
cases in which the basic letters of the 0] and 0 2 superimposed components are identical, where- 
upon the plain-text letters indicated are at once inserted into position. In this example 10 
such cases are found, one each in periods 14, 22, 26, 35, 36, 52, 59, 68, and two in period 74. 
All of these, of course, involve letters in odd positions in the periods. The plain-text letters 
thus inserted may serve as clues for assuming probable words. 

d. Now if only a few equivalencies can be established between a few of the 0i components, 
or between a few of the 0 2 components, or between a few 0, and 0 2 components, a long step for- 
ward may be taken in the solution. Perhaps some information can be found by studying 
figures 90 and 91. A consideration of figure 90 will soon lead to the idea that each row of fre- 
quencies can indicate only 5 different plain-text letters, one of which coincides with the indicating 
letter at the left of the row. Moreover, in this same figure, while there are 25 rows in all, there 
are really only 5 different categories of rows, each category corresponding to a row in the 
substitution checkerboard. 



e. To explain quite dearly what is meant and how the principle can be employed in this case, 
assume that figure 90, instead of applying to an unknown checkerboard, applied to a known 
one, say that shown in figure 87. The bipartite coordinates and the letters which would occupy 
the cells are as seen in figure 92: 

21 123554451132343524 12345 
ABCDEFGHIKLMNOPQRSTUVWXYZ 
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Now consider the A row and the F row. The 25 letters in both rows of cells are, from the very 
nature of the system, identical in their sequence and there are only 5 different letters involved, 
each appearing 5 times. Therefore it would seem that frequency distributions corresponding to 
these rows should show definite characteristics by means of which they could be compared 
statistically. Furthermore, the 0, coordinates applying to these two rows, Ai and F h indicate 
that A and F are in the same row in the checkerboard. What has been said of the A and F rows 
also applies to the M, N, and U rows, for the letters A, F, M, N, and U are all in the same row in the 
checkerboard (fig. 87). Perhaps a statistical test can be applied to ascertain which rows of 
distributions in figure 90 are similar and this in turn may give clues to the letters which fall in 
the same row in the checkerboard applicable to the problem in hand. 

f. Again, consider the columns in figure 90. What has been said of the rows applies equally 
to the columns, and therefore the same sort of test may also be applied to the columns of figure 
90 for clues as to the composition of the columns of the checkerboard applicable to the problem 
under consideration. If there were sufficient text much of the labor of solving such cases would 
be reduced to a matter of statistical analysis. But what sort of statistical test should be used? 
Obviously it should be one based upon “matching” the distributions of figure 90, but specifically 
what should it be? Note the distributions in rows D and M; they appear to be similar. Is it 
correct to apply the usual x-test for matching two frequency distributions? Consider the com- 
position of the rows of figure 90, and specifically consider the A and F rows, composed as follows: 



A____ AMMANFFUUFMMNANUNFAUMANUF 

F AMMANFFUUFMMNANUNFAUMANUF 



Here the letters in opposite cells are identical and there are only 5 different letters involved: 
A, M, N, F, and U. Of these only 3 are high-frequency letters in normal plain text; 2 are of medium 
to low frequency. But the high-frequency letters in the A row match those in the F row, the 
low-frequency letters in the A row also match the low-frequency letters in the F row. Hence, 
if frequency distributions corresponding to these rows are tested statistically, they should yield 
a fairly high index of coincidence. But should the constant .0667 (probability of monographic 
coincidence in normal English text) be used in the test? Obviously not, for this constant is derived 
from statistics based upon the normal frequencies of all 26 letters of the alphabet, whereas here 
only 5 letters are involved and the exact 5 involved in any example is determined by the compo- 
sition of the checkerboard. Again, consider the A and C rows of figure 90, composed as follows: 



A AMMANFFUUFMMNANUNFAUMANUF 

TCCTRGGIIGCCRTRIRGTICTRIG 



Here is a case where, by chance, high-frequency letters stand opposite high-frequency letters 
(A and T, N and R) ; medium-frequency letters stand opposite medium-frequency letters (M and 
C, F and G). The only case of fairly marked difference is in that of the pairing of U and I. 
Hence, a statistical matching of frequency distributions applying to these two rows would be 
apt to yield a high index of coincidence. Yet, these two rows do not belong together and to 
assume that the letters A and C belong in the same row in the checkerboard would block or at 
least retar4 solution. In spite of the foregoing reasoning, there nevertheless remains the feeling 
that a statistical matching of the rows should be possible or should at least offer some clues as 
to the composition of the checkerboard. 

g. In applying the usual x-test for matching two distributions use is made of the important 
constant .0667, the probability of monographic coincidence for normal English text. This 
constant may be modified to meet the special conditions of the present problem. If it be assumed 
that the mixing of the letters in the checkerboard is fairly good, in normal cases it may be assumed 










i 

j 
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that there will be 1 high-frequency letter, 3 medium-frequency letters, and 1 low-frequency 
letter in each row and in each column of the checkerboard. Suppose the letters in each category 
be as follows: 

High frequency AEINORST 

Medium frequency BCDFGHLMPUY 

Low frequency K Q V W X Z 

Adding the squares of the probabilities for separate occurrence 6 of the letters in each category: 



A .0054 B 

E .0169 C 

I .0054 D 

N .0063 F 

0 .0057 G 

R .0057 H 

S .0037 L 

T .0084 M 

P 

Total= . 0575 U 

Average= . 0072 Y 



.0001 


K 


.0000 


.0009 


Q 


.0000 


.0018 


V 


.0002 


.0008 


w 


.0002 


.0003 


X 


.0000 


.0012 

.0013 


z 


.0000 


.0006 


Total = 


.0004 


.0007 

.0007 

.0004 


Average = 


.00007 



Total = . 0088 
Average = . 0008 

Since each row of figure 90 contains 25 letters, composed of 5 different letters each appearing 5 
times, and it is assumed that each row of the checkerboard contains 2 high-frequency letters, 2 
medium-frequency letters, and 1 low-frequency letter, the rows in figure 90 will be composed of 
10 high-frequency letters, 10 medium-frequency letters, and 5 low-frequency letters. Therefore, 
the sum of the squares of the average probabilities of the letters occurring in each row of figure 
90 is as follows: 



5 X- 0072 =.0360 
15X 0008 = . 0120 
5 X. 00007 = .0004 



Total =.0484 

This, then, is the constant that should be applied in the x-test for the problem under consider- 
ation. Suppose, for convenience, the approximation .05 is used. This is considerably less than 
the normal constant .0667 and means that in the case of this problem two distributions can be 
considered to “match” even if the number of coincidences (value of x) is considerably less than 
what would be expected in the case of the normal type of frequency distribution. However, it 
must be remembered that even if two distributions give an observed value for x that is close to 
or even greater than the expected, one can still not be certain that the two distributions apply to 
identical rows of letters and indicate two letters in the same row in the checkerboard, since it 
may happen that the composition of the checkerboard is such that two rows have letters of about 
the same frequency values, as pointed out above. 

h. With this reservation in mind, let figure 90 be examined. Take rows D and M, which on 
casual examination look a good deal alike, as seen in figure 93. 



5 As given in the table on p. 114 of Military Cryptanalysis, Part 1, Appendix 2, par. 2e (1). 
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A 


B 


C 


D 


E 


F 


G 


H 


1 


K 


L 


M 


N 


0 


P 


Q 


R 


S 


T 


U 


V 


W 


X 


Y 


Z 


Di 




§ 










































5 






Mi 





















































N— 23 
N=16 



Fiqubr 93. 

Applying the x-test, the observed value of x=34, the expected value is .05 (23X16) =18. An 
excellent match is obtained, arid the hypothesis that D and M are in the same row in the checker- 
board seems promising. Can any confirmation be found in the cryptogram itself? 

i. It has already been pointed out that this system reduces to monoalphabetic substitution 
with variants. This being the case it should be possible to find manifestations of equivalency 



If the student will think 



0 

between some of the variant forms of 1 vertical pairs in the cryptogram. 

02 

over the matter he will quickly see that this manifestation of equivalency is but a reflection of 
the principle elucidated in paragraph 46, expressed in a little different way. In other words, 
establishing equivalence between two 9i components means that the two base letters involved 
belong in the same row of the checkerboard ; establishing equivalence betweeen two 0 2 compo- 
nents means that the two base letters involved belong in the same column of the checkerboard. 
Note the following instances of apparent equivalency between Di and 



Period 16 


D2 Bi 


Di B 2 






Period 1 8 


GiQt 


Di Qi 


20 


Y 2 B t 


Di B 2 






32 


L s Q, 


Mi Qi 


49 


T 2 B! 


Di B 2 






16 


F 2 Ei 


Di E 2 


2 


Y 2 B! 


Mj B 2 






17 


F2 Ei 


Di E 2 


3 


Z 2 Gi 


D, G 2 






59 


G2 Ei 


M, E 2 


56 


N 2 G t 


M, G 2 






12 


Ai B 2 


A2 Di Bi D2 


13 


Q2 Li 


Di L12 






50 


AiBi 


A2 Di Hi D2 


37 


Z2 Li 


Di L 2 






8 


Di Bi 


D 2 Mi Ri M 2 


58 


N 2 Li 


Di L2 






19 


D1N2 


D2 Di Ui D2 


66 


ZiU 


Di L12 






46 


Dili 


D2 Di Ni D2 


71 


Zj Li 


Di U 






44 


Di Zi 


Ds Mi Bi M§ 


6 


Ai Li 


Mi L s 






43 


Ui Ai 


U2 Di Ci D2 


13 


Yj Li 


Mi Li 






67 


U,Ei 


U 2 Mi Pi M 2 


58 


I2L1 


Mi Li 












It may be assumed Di 


=Mj and the two distributions in figure 93 may be amalgamated. 


D! + M, k_ 


B C D E 


F G H 




K L 


M N 0 P Q R 


S T U 


V W X Y Z 




i § 


" =5 " 


— 




5: ^ ^ ^ 




" § " " 










§ 








The only other row in 


figure 90 which gives indications of being similar to this distribution is the 


A row. Applying the 


X-test individually to the Di and Mi distributions, and then to the combined 


D!+M, distribution: 
















n A 


B C D E 


F G H 


I 


K L 


M N 0 P Q R 


STUVWXYZ 


Di 










" 




5 " " N=23 


Ai 




^ $ 




- 




- 


II 

III 

Z 

II 

to 
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Expected for plain text: .05 (23X21)=24 

Expected for random text: .038 (23X21) = 18 
Observed =26 



Mi 


ABCDEFGHIKLMNOPQRSTUV 


W X Y Z 


N=16 


A, 


5 - ^ ^ | " 


=5 5 


T— < 

II 

s 




Expected for plain text: .05 (16X21) = 17 








Expected for random text: .038 (16X21) = 13 








Observed = 14 








ABCDEFGHIKLMNOPQRSTUV 


W X Y Z 




D.Mi 




" 


N=39 


A, 






N=21 



Expected for plain text: .05 (39X21)=41 

Expected for random text: .038 (39X21)=31 
Observed =39 

From the foregoing calculations it appears that A t may be similar to the Di and the Mi distribu- 
tions, for the observed values, while not as great as expected for plain text, are higher than those 
expected for random text. Perhaps more conclusive evidence may be found if a search were 
made through the text to see if any equivalences between Ai» Di, and Mj, appear. 

Note the following cases: 



Period 8 


Y 2 B, 


Ai 


b 2 


A a M! 


Period 33 


I* Pi 


A!P 2 


A3 Wi 


12 


N 2 B! 


Ai 


b 2 


A 2 Di 


48 


U 2 P, 


m,p 2 


0i M3 


50 

16 

20 

49 


N,B, 
D 2 Bi 
Y 2 Bi 
t 2 b, 


A, 

Di 

Di 

D, 


b 2 

b 2 

b 2 

b 2 


A 2 Di 
D 2 Ai 
D 2 Ai 
D 2 Fi 


15 

18 

32 


Gs Qi 

g 2 q, 

La Qi 


Ai Qa 
Di Q 2 
M, Qa 


A 2 Bi 

DiN 2 

m 2 h, 


2 


y 2 b, 


Mx 


b 2 


m 2 r, 


14 


n 2 x, 


a,x 2 


A 2 Ci 


21 


c 2 Gi 


A t 


G2 


a 2 x, 


61 


F 2 Xj 


Di X 2 


d 2 h, 


30 


K 2 Gi 


At 


G2 


s,p 2 


57 


Q 2 Yi 


a,y 2 


i! Da 


3 


z 3 g 1 


Di 


Ga 


b,k 2 


72 


f 2 y, 


A, Y 2 


A 2 Di 


56 


n 2 g, 


Mi 


g 2 


m 2 r, 


63 


u 2 y, 


D, Y 2 


Da Ai 


24 


x 2 k, 


Ai 


k 2 


Ri Z 2 










34 


t 2 k. 


M! 


k 2 


M 2 Qi 











It certainly seems as though A 1 =Di=M 1 , and that these letters are in the same row in the checker- 
board. This tentatively will be assumed to be correct. 
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174 

j. Among the most frequent combinations is the pair Y S B], appearing in the following 
sequences: 



Period 2 


Y a Ci 


Y!C 2 


Y 2 B! 


Mi B 2 


M 2 Ri 


8 


Li & 


Yi W 2 


y 2 b, 


Ai Ba 


a 2 m, 


10 


Bi A 2 


Y!0 2 


Y 2 Bi 


Ei B 2 


e 2 Ri 


20 


N, L a 


YiWa 


Y 2 B! 


Di B 2 


D 2 Ai 


41 


Hi L 2 


Yi M 2 


y 2 B, 


Si B 2 


S 2 0i 



Note how Mj, A u E u Di, and Si all appear to be interchangeable. Are these the 5 letters which 
belong in the same row? The probable equivalence among Aj, D 1( and Mi has been established by 
noting cases of equivalency in the text. A further search will be made to see if Ei and Sj also 
show equivalencies with k u D lf and M x . 

Note the following: 



Period 21 


C 2 Gi 


Ai G 2 




Period 12 


N S B, 


Ai Ba 


A 2 Di 


30 


K 2 Gi 


Ai Ga 




10 


YaB, 


Ei B 2 


Ea Ri 


3 

69 

56 


ZaG, 

OaGx 

NaGi 


DiGa 
Ei G a 
M t Ga 




30 

33 


La Pi 
LaP, 


Ei Pa 
A, P, 


E 2 Ri 
A 2 W, 


23 

32 


D,Xa 
Mi Qa 


Da Hi 
Ma Hi 


Ai H a 
A, Ha 


43 

57 


CaY, 
Qa Yi 


Ei Ya 
AiYa 


IiLa 
Ii Da 


61 


DiXa 


D a H, 


Ei Ha 











Here are indications that Ej belongs to the same series, but not enough cases where Si is inter- 
changeable with A, D, E, or M can be found to be convincing. But perhaps it is best not to go 
too fast in these early stages. Let it be assumed for the present that A, D, E, and M are in the 
same row of the substitution checkerboard. In period 16 there is the pair of vertical com- 
ponents Di E 2 . Since D l =E 1 this pair may be written EiE 2 , whereupon the plain-text letter E is 
immediately indicated. All cases of this sort are sought in the text and the plain-text letters 
are inserted in their proper places, there being 7 such instances in all, but these yield the im- 
portant letters, A, D, and E. 

k. In a similar manner, by an intensive search for cases in which components appear to be 
equivalent because they occur in repetitions which are identical save for one or two components, 
it is established that C, 0, M, and W are in the same column in the checkerboard. Note the bracket- 
ing of these letters occurring as 0 2 components in the 4th column of the first list of sequences 
in subparagraph j. Likewise, B, H, and N are established as being in the same row. Again 
the text is examined for cases in which plain-text letters C, 0, M, W, B, H, and N may be inserted. 
By carrying out this process to the full extent possible, the skeletons of words will soon begin 
to appear. 

l. Enough has been demonstrated to show this line of attack. Of course, if there is a large 
volume of text at hand, the simplest procedure would be to construct frequency distributions 
of the types shown in figures 90 and 91, and use the statistical method to match the individual 
distributions. For this method to be reliable it would be necessary to have several hundred 
letters of text, but this in actual practice would not be too much to expect. 

m. There is, however, another line of attack, based upon the probable-word method. It 
has been pointed out that, in the case of letters in odd positions in the periods, 40 percent of the 
time the plain-text letter involved is indicated by either its 0 t or 0 2 component. This property 
affords a fair basis for assuming a probable word. For example, the cryptogram here studied 
shows the following two periods: 
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Period. 

Plain text 

Components...... 




35 

S 


36 

L 


[ V » V 2 H i 

Li* x, x 2 


H 2 Si S 2 Ii 
Si S 2 L i L 2 


L i Lt.Wi W* Xi X 2 L i 
L a Xi.Xt Ri R t Si Si 


Cipher text 


V H S 


I X S L 


LWXLXRS 


Two letters are quite definite, S, and L, 


. Suppose the 


possible plain-text letters be indicated. 


Period 




35 


36 


Possible plain-1 


fV . H 


. S . I 


L . W . X . L 


text letters ] 


[I X 


L 


X R S 


Components- j 


rvi w Hi 
[I s X, X 2 


HiSiSili 

Si S j L i L 2 


L, L s Wi W 2 Xi X 2 L, 
L 2 X i X 2 R i R 2 Si S 2 



Ciphertext. V HSIXSL LWXLXRS 



The word HOSTILE is suggested by the letters H . S . I L . . This word will be assumed to be 
correct and it will be written out with its components under the cipher components. Thus: 



Period 

Plain text 

Cipher-text components. 

Plain-text components... 



35 


36 


H 0 S T I 


L E 


Vi V 2 Hi H s Si S 2 Ii 


Li Li 


I 2 X, X 2 S, S 2 L, L 2 


l 2 x, 


Hi Oi Si Ti Ii 


L, Ei 


H 2 O 2 S 2 T 2 1* 


L 2 E 2 



This word, if correct, yields the following equivalencies: H*= X 2 =0i;Si=0 2 ; Tj=S 2 ; Li=T 2 ; I 2 — 
Lji=Ei ; X 1 ==E 2 . Again the text is examined for cases in which the plain-text letters may now be 
directly inserted; but only one case is found, in period 44, where Ii L^Ii I 2 =I P . This is un- 
fortunate, so that additional words will have to be assumed. The 14th period shows a C p 
and the components after it suggest that the word CROSSROADS may be present. Thus: 



Period 14 15 

Plaintext PRO S S R 0 A D S 

p, . Nj N 2 Ai A 2 Ci C 2 Oi Ri R 2 Gi G 2 Ai A 2 Si 

components... p 2 x t X 2 C, C 2 R t R 2 S 2 ff t ff 2 Q, Q 2 B 1 B 2 

Ciphertext. , NACOXCR RGASWQB 



Take the first letter R p , represented by C 2 Ri. 

Since R D =C 2 Ri, 
Therefore, Ri R 2 =C 2 R t 

Hence Ri=C 2 and R 2 =Ri 
Therefore, Ri=R 2 =C 2 

Again, in the case of the first 0 P , 

0 p =0i R 2 

But 0 P = Oi 0 2 === 0i R 2 
0 2 =R 2 

Therefore, Ri=R 2 =0 2 =C 2 



176 



The various equivalencies yielded are as follows: 

C s =E 1 = 0 2 =S 1 =R 2 =Gi=ff 2 =Q 1 

Sj=W l =Bj=T 1 

H 2 =Xj=0x=Gi 

Oi=Qi 

Qs=Aj=D l 



Bi=D 2 
Li=T 2 
L 2 = I 2 =Ei 
Xx=E 2 



n. Let all the equivalencies found thus far from subparagraphs e,f, and h be collected in two 
tables, as shown in figure 94, one for Qj 0 2 combinations, the other for 0 2 0, combinations. 



OD 



< 

& 

HH 

PQ 

s 

o 

o 

<£ 

© 



00 

S5 

O 

P 

1 5 

►H 

« 

a 

o 

o 

& 



-i B| C » Dl El H 1 K 1 Li Ml Ni Oi Pi Qi Rx Si Ti U t V, w x X t Yi Z x 



D, Hi 
Ex N, 

Mx Dj 

I* 

Ls 

A 2 

Qi 



Ax Ax 
Ex Dx 

Mi Mi 
I, Is 
Lj Ls 
A 2 a 2 
Qi Q> 



0 2 Bi 

C 2 Ni 
M 2 D 2 
Wi 

Ri 

Rs 

s, 

Qi 



T 2 Ai Bi H 2 Gi Gi 0 2 S 2 



Di Hi Xs 

E! D 2 Gj 

I 2 

U 

A 2 

Qi 



0 2 C 2 C, Wi 
C| 0 2 M 2 B 2 
Mi Mi W 2 
W 2 W 2 Ri 
Ri R 2 R 2 
Rs Sj Gi 
Si Qi Qi 



TiE 2 

Si 

B, 



A* B » Ca D » E * F » G « H 2 I; Ki Li M, N 2 0 2 P 2 Q 2 R 2 S 2 T 2 U 2 V 2 ff 2 X 2 Y 2 Z 2 



Ai T, M 2 Bi Xi 
D i S 2 0 2 Hi 
Ei Wi W 2 Ni 
Mi R, 

Si 
Ri 
G, 

Qi 



Oi X 2 L, 

H| Oi Ai 

X 2 Gj Di 
E, 

Mi 

As 

Qi 



Is C 2 
Ai Os 
Di W, 

Ei Ri 

Mi Si 
As R 2 
Qi Gi 
Qi 

Fioue* 94 



Cs 

Ms 

W 2 

Si 

Ri 

Rs 

Gi 

Qi 



Ls C 2 Ti Li 
I 2 M 2 Wi 

Ai Os Bs 
Di W 2 
Ei Si 

Mi Ri 

A 2 Gi 
Qi 



C 2 H 2 
M 2 Oi 
0 2 G2 
Si 
Ri 
R s 

Gi 

Qi 



A study of the equivalencies indicates that — . 

(1) A, D, E, M belong in the same row. 

(2) B, H, N belong in the same row. 

' ’(3) G, R, S, Q belong in the same row. 

(4) R, C, 0, M, W belong in the same column. 

(5) I, L, A, Q belong in the same column. 

(6) X, H, G belong in the same column. 

(7) The coordinates of R and A are identical and hence this letter occupies a cell along 

a diagonal sloping from left to right in the matrix. 

o. Since a row or a column can contain only 5 letters, it is obvious that A D E M B H N' 
and G, R, Q S, fall in 3 different rows; C, 0, M, W, R and I, L, A, Q fall in different columns. ’ A 
start may be made by an arbitrary placement of R in the position 1-1, and since Ri=0 3 =C a = 
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m,=W S) this means that R, 0, C, M, and ff form one column in the substitution checkerboard, as 
shown in figure 95-A. The data also indicate that R, G, Q, and S must be in row 1, A, D, and E 



2* component 

1 2 3 4 5 



R 










C 










0 










M 










ff 











GS 

X 

ADE 



H I 
X L 

Fioub* «*-A. 



must be in row 4, H and X must be in column 3. This means that 0, for A, D, and E must be 4, 
and that 0 2 for H and X must be 3. And since M, = I 2 =L 2) 0 2 for I and L must be 4. Substitut- 
ing in the text the coordinates for the known values, additional plain-text words soon become 
evident. For example, taking the periods with the word HOSTILE, it becomes possible to insert 



Period 

Plain text 

Components... 



35 ^jj 
H 0 S T I j| 

Vi V t Hi H 2 Si S 2 Ii 1 
I 2 X i X 2 S| S 2 L| 1^ 



Cipher text V H S I X S L 



36 



L E 



Li Lj ff, W t X, X, L 
Lji X, X 2 R, R 2 S, S 

L W X L X R S 



1 

2 



the letters R p and 0 D as the second and fourth letters after Ep, suggesting that the word after 
HOSTILE is TROOP. This gives ff, X 2 =T B , which permits of placing T in position 5-3. Since T in 
H0STILE=S 2 L,, therefore S 2 = 5 and L,=3. Since S is in row 1, and S 2 =5, S must go in position 
1-5. Since L 2 =4 and L,— 3, L must go in position 3-4. Since 0 P (the 1st 0 in TROOP) =X,R 2 
and it is known that 0 P =3-1, therefore X must be in position 3-3. The checkerboard is now as 
shown in figure 95-B. From figure 94, X,=E 2 . Now X,=3, and since the E must be in row 4, 



e. 



02 





1 


2 


3 


4 


5 


1 


R 








S 


2 


C 










3 


0 




X 


L 




4 


M 










5 


ff 




T 







G 



ADE 



e. 



©2 





1 


2 


3 


4 


5 


1 


R 








S 


2 


C 










3 


0 




X 


L 




4 


M 




E 






5 


ff 




T 








AD 



H I 

Figubi 9S-B. 



H I 

Figoti 95-C. 
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it is evident that E must occupy cell 4-3, as seen in figure 95— C.- There are now only 2 possible 
rows for H, either 1 or 2. It is deemed unnecessary to give further details of the process. Suffice 
it to say that in a few minutes the entire checkerboard is found to be as shown in figure 95-D. 
It will decipher the entire cryptogram as it stands, but speculating upon the presence of W U T V Z 
in the last row, and assuming a key-word mixed sequence has brought this about, a rearrange- 
ment of the columns of the checkerboard is made to give T U V W Z, as shown in figure 95-E. 
The arrangement of the rows now becomes quite evident and the original checkerboard is found 
to be as shown in figure 95-F. It seems to be based upon the key phrase XYLOPHONIC BEDLAM. 



02 





1 


2 


3 


4 


5 


1 


R 


K 


G 


Q 


S 


2 


C 


N 


H 


I 


B 


0i 3 


0 


Y 


X 


L 


P 


4 


M 


D 


E 


A 


F 


5 


ff 


U 


T 


V 


Z 



Figoke 95-D. 



02 





3 


2 


4 


1 


5 


1 


G 


K 


Q 


R 


S 


2 


H 


N 


I 


C 


B 


0, 3 


X 


Y 


L 


0 


P 


4 


E 


D 


A 


M 


F 


5 


T 


U 


V 


W 


Z 



Fiqdeb 95-E. 



02 





1 


2 


3 


4 


5 


1 


X 


Y 


L 


0 


P 


2 


H 


N 


I 


C 


B 


0, 3 


E 


D 


A 


M 


F 


4 


G 


K 


Q 


R 


S 


5 


T 


U 


V 


ff 


Z 



Frarsi 95-F. 



p. The completely deciphered cryptogram is as follows: 



SITUATI ONONFRO NTOFTWE NTYFOUR 



4 2 6 5 3 5 2 

5 3 12 3 13 

KZFBEIL 



5 2 2 

115 



2 4 3 

3 13 



UCCEPQL 



35 



9 



B A T T A L I 

2 3 5 5 3 1 2 

5 3 1 1 3 3 3 

I Z E B E L A 



13 



1 2 3 4 4 3 3 

2 1 3 5 4 1 3 

Y M Q D L W L 

w 



1 2 1 
4 2 4 



2 3 4 1 

2 5 4 4 



2 5 1 3 5 5 3 
2 14 5 14 1 



Y Y M 0 C B R 

14 

6 



2 6 13 1 

2 12 5 4 



3 3 3 4 3 

2 13 5 5 



1 1 
4 3 



A M E Y L Z Q 

42 

10 



1 1 5 4 2 1 1 

3 4 4 5 4 4 3 

X W H L R ff Q 

49 

11 



2 3 2 

2 5 3 



1 2 3 1 4 5 1 

4 2 5 4 4 1 2 

Y E S 0 B R Y 

70 

14 



4 3 5 3 2 5 2 

5 13 12 11 

Q V B B L Y X 

77 

15 



2 2 3 

4 1 1 



3 2 4 1 

2 4 4 4 



4 4 4 1 3 3 4 

5 5 4 4 3 2 5 



NACOXCR RGASWQB 



BLZDOTG BLPKYWC 



THBRIGA DEASFOL LOWSCOL ONFIRST 



4 4 5 

4 6 1 



Y D R ff B M T 

56 

12 



0NF0RTY SEVENTH INFANTR 



2 2 3 3 2 5 4 

3 2 5 3 2 1 4 

N A B Q B D 0 

84 

16 



YHASREA CHEDCRO SSROADS EVENFIV 



3 5 3 2 3 2 6 

1 3 1 2 5 3 3 

FDD IEBA 
112 
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17 














18 














19 














20 








E 


S 


E 


V 


E 


N D 


D 


A 


s 


H 


R 


0 


A 


D 


J 


u 


N 


c 


T 


I 


0 


N 


F 


I 


V 


E 


T 


3 


4 


3 


8 


3 


2 


3 


3 


3 


4 


2 


4 


I 


3 


3 


2 


8 


-2 


2 


5 


2 


l 


2 


3 


2 


5 


3 


3 


1 


.6 


1 


‘3 
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q. The steps taken in recovering the original substitution checkerboard demonstrate that 
cyclic permutations of a correct checkerboard will serve to decipher such a cryptogram just as 
well as the original checkerboard. In other words, a cryptogram prepared according to this 
method is decipherable by factorial 5 (5X4X3X2X1 = 120) checkerboards, all of which are 
cyclically equivalent. Even though the identities of the components will be different if the 
same message is enciphered by two different cyclically-equivalent checkerboards, when these 
components are recombined, they will yield identical cipher texts, and therefore so far as external 
appearances are concerned different checkerboards yield identical cryptograms. The reason 
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that there are only factorial 5 cyclically-equivalent checkerboards and not factorial 10, is that 
whatever permutation is applied to the row coordinates must be the same as that applied to the 
column coordinates in order that the aforesaid relationship hold true. If two checkerboards 
have identical row coordinates but different column coordinates certain portions of the crypto- 
graphic text will decipher correctly, others incorrectly. For this reason, in working with cryp- 
tograms of this type the cryptanalyst may successfully use a checkerboard which is incorrect in 
part and correct it as he progresses with the solution. It may also be added that the actual 
permutation of digits applied to the side and top of the checkerboard is of no consequence, so 
long as the permutations are identical. In other words, the permutation 5-2-1-3-4 will work 
just as well as 3-2-4-1-5, or 1-2-3-4-5, etc., so long as the same permutation is used for both 
row and column coordinates. It is the order of the rows and columns in the checkerboard 
which is the determining element in this system. Any arrangement (of the letters within the 
checkerboard) which retains the original order as regards the letters within rows and columns 
will work just as well as the original checkerboard. 

r. A final remark may be worth adding. After all, the security of cryptograms enciphered 
by the bifid fractionating method rests upon the secrecy inherent in a 25-cell matrix containing 
a single mixed alphabet. In ordinary substitution, a single mixed alphabet hardly provides any 
security at all. Why does the bifid system, which also uses only a single mixed alphabet, yield 
so much higher a degree of security? Is it because of the transpositional features involved? 
Thinking about this point gives a negative answer, for after all, finding the length of the periods 
and replacing the cryptographic text by components based upon the cipher letters is a relatively 
easy matter. The transpositional features are really insignificant. No, the answer to the 
question lies in a different direction and may be summed up about as follows. In solving a 
simple mixed-alphabet substitution cipher one can attack a few cipher letters (the ones of greatest 
frequency) and find their equivalents, yielding fragments of good plain text here and there in 
the cipher text. Once a few values have been established in this manner, say 6 values, the 
remaining 20 values can be found almost from the context alone. And in establishing these 6 
values, the letters involved are not so interrelated that all 6 have to be ascertained simultane- 
ously. The cryptanalyst may establish the values one at a time. But in the case of the bifid system 
the equivalents of the plain-text letters are so interrelated that the cryptanalyst is forced to 
assume or establish the positions of several letters in the checkerboard simultaneously, not one 
by one. In other words, to use an analogy which may be only partially justified, the solution 
of a simple monoalpha betic substitution cipher is somewhat like forcing one’s way into an inner 
chamber which has a number of doors each having a single lock; the solution of a bifid fraction- 
ated cipher is somewhat like getting into a vault — there is only one door which is provided with 
a complex 5-combination lock and all the tumblers of the lock must be positioned correctly 
simultaneously before the releasing lever can drop into the slot and the door opened. Funda- 
mentally, this principle is responsible for the very much greater security of the bifid system as 
compared with that afforded by the simple monoalphabetic system. It is a principle well worth 
remembering and speculating upon. 

53. Special solutions for bifid systems. — a. The security of the bifid system is very con- 
siderably reduced if the situation in which it is employed happens to be such that two or more 
messages with identical beginnings, endings, or internal portions can often be expected to occur. 
For in this case it is possible to establish equivalencies between components and quickly recon- 
struct the substitution checkerboard. An example will be given to illustrate the steps in a 
specific case. 

b. Here are two cryptograms transmitted by two coordinate units to a superior head- 
quarters at about the same time. They show certain identities, which have been underlined. 



No. 1. QVBBL YXNAB QBDO Y HOND W V UYTE MHfiZD QTLKE EWAPK QSLIP QDWC 

No. 2. VBN HY X DABG BDOIH OBNWV LYTFW HQXDQ VLKEW WAX DQ SA BCA NXGX 

c. Apparently these two cryptograms contain almost identical texts. In order to bring the 
identities into the form of superimposed components, it is necessary to transcribe the texts into 
periods of 7 and to superimpose the two messages as shown in figure 96. 

d. The shifting of the second cryptogram 2 intervals to the right brings about the superim- 
position of the majority of 9j and 0 2 components and it may be assumed that for the most part 
the texts are identical. Allowing for slight differences at the beginnings and ends of the two 
messages, suppose a table of equivalencies is drawn up, beginning with the eighth superimposed 

pairs. Thus, !? 1= !? 2 ; hence Nj=N a and Q 2 =Di. hence N 2 — H, and B,=D 2 . Going through 

the text in this manner and terminating with the 42d superimposed pairs, the results are tabulated 
as shown in figure 97. 

e. From these equivalencies it is possible to reconstruct, if not the complete substitution 
matrix, then at least a portion of the matrix. For example, the data show that N, H, B, and I 
belong in the same row; E and F belong in the same row; N, D, U, Y, and K belong in the same 
column, and so on. Experimentation to make all the data fit one checkerboard would sooner or 
later result in reconstructing the checkerboard shown in figure 95-F, and the two messages read 
as follows: 

1. SEVENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN FOUR. 

2. TENTH INFANTRY IN POSITION TO ATTACK AT FOUR AM PLAN THREEX. 

j. The foregoing gives a clue to what would happen in the case of an extensive traffic in 
which long phrases or entire sentences may be expected to occur repeatedly. By a proper 
indexing of all the material, identical sequences would be uncovered and these, attacked along 
the lines indicated, would soon result in reconstructing the checkerboard, whereupon all the 
messages may be read with ease. 

54. Solution of trifid systems. — a. In the trifid fractionating system the cipher alphabet is 
tripartite in nature, that is, the plain-text letters are represented by permutations of 3 com- 
ponents taken in groups of 3’s, thus forming a set of 27 equivalents, such as that shown below: 



A=1 1 1 


J=211 


S=311 


B=1 12 


K=212 


T=312 


C=1 13 


L=2 13 


U=313 


D=121 


M=221 


V=321 


E=122 


N=222 


W=322 


F=123 


0=223 


X=323 


G= 1 3 1 


P=231 


Y=331 


H=132 


Q=232 


Z=332 


1=133 


R=233 


?=333 



b. The equivalents may, of course, be arranged in a mixed order, and it is possible to use one 
tripartite alphabet for decomposition and a wholly different one for recomposition. One dis- 
advantage of such an alphabet is that it is a 27-element alphabet and therefore some subterfuge 
must be adopted as regards the 27th element, such as that illustrated in the footnote to paragraph 
57 of Special Text No. 166, Advanced Military Cryptography, wherein ZA stands for Z and ZB 
for the 27th character. 
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1 2 3 4 5 6 7 


8 9 10 11 12 13 14 


15 16 17 18 19 20 21 


22 23 24 25 26 27 28 


29 30 31 32 33 34 35 


36 37 38 39 40 41 42 


43 44 45 46 47 48 49 


Qi Qs Vi V, B, B, B, 

B* Lj L 2 Yi Y 2 X, X 2 
No. 1 Q V B B L Y X 

Vi V 2 Bi B 2 N, N 2 H, 
H* Y, Y 2 X, X 2 D, D 2 
No. 2 V B N H Y X D 


Ni N s Ai A 2 B, B 2 Q, 

Q 2 Bi B 2 D, D 2 Oi 0 2 
N A_B Q B D 0 

Aj A 2 Bi B 2 Gi G 2 Bi 
B 2 Di Dj Oi 0 2 Ii I 2 
A_B G B D_0 I 


Y, Y 2 H, H 2 0! 0 2 N, 

N 2 D, D 2 W, W 2 Vi V 2 
Y H_0 N D W V 

Hi H 2 0, 0 2 Bi B 2 Ni 
N 2 %Wi V t V 2 L, L 2 
HOBNffVL 


Ui U 2 Y, Yj T, T 2 E, 

E, U, M 2 Hi H 2 Qi Q 2 
U Y_T EMHfl 

Y, Y 2 T, T 2 F, F 2 Wi 
W 2 Hi H 2 Qi Q 2 Xi X 2 
Y T F W H_Q X 


Z, Z 2 Di D 2 Qi Q 2 T, 

T 2 Li L 2 K, Kj El E 2 
Z D Q T L K T? 

D, D 2 Q, Q 2 V x V 2 L, 
L 2 K, K 2 El E s W, W 2 
D Q V L K E W 


Ei Ei Wi W 2 Ai A 2 P i 
P 2 Ki K 2 Q, Q 2 Si S 
E W_A FT Q_S ~ 

Wi W 2 Ai A 2 Xi X 2 Di 
D2 Qi Q 2 Si S 2 Ai A 2 
W A X D Q S A 


Li L 2 Ii X 2 Pi P 2 Qi 
Q 2 Di D 2 Wi W 2 Ci C 2 
LIP Q D W C 

Bi B 2 Ci C 2 Ai A 2 Ni 
N s Xi X 2 G, G, X, X 2 
B C A N X G X 



Figure 96. 
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.■■■■. e. The various types of fractionation possible in bifid systems ere also adaptable in trifid 
systems. For example, using the alphabet shown above for recomposition as well as decom- 
position the encipherment of a message in periods of 7 is as follows: 

.it EL I E F 0 FYOURRE GIMENTT 0 If 0 R R 0 W 

) 2i 3. iil a i s sl a a a i l l a i a a. 8 a a a a a a a 

aaiaaaa a a a l a a a aaaaaii a a a a a a a 

a a a a a a 8 axaaaaa l a i a a a a a l a a a 8 a 

JAQHORR HVFLXIZ B F 7 N A T N NNWR.OIZ 
Cbtptogbam 

KAQHO RRHVF LXIZA BFZBN ATNNN WROIZ 

d. The solution of a single cryptogram of this nature would be a quite difficult matter, espe- 
cially if there were nothing upon which to make assumptions for probable words. But. a whole 
series of cryptograms could be solved, following in general the procedure outlined in the case of 
the bifid system, although the solution is, admittedly, much more complicated. The first step 
is to ascertain the length of the period, and when this has been done, transcribe the cipher text 
into components, which in their vertical combinations then represent monoalphabetic equiva- 
lents, with, of course, many variants for each letter of the plain text. Then a study is made to 
establish component equivalents, just as in the bifid system. If the text is replete with repeti- 
tions, or if a long word or a short phrase may be assumed to be present, a start may be made and 
once this sort of entering wedge has been forced into the structure, its further disintegration and 
ultimate complete demolition is only a matter of time and patience. 

55. Concluding remarks on fractionating systems. — a. It goes without saying that the 
basic principles of fractionation in the bifid and trifid systems are susceptible to a great deal of 
variation and complication. For example, instead of having periods of fixed length through the 
message it is possible to vary the length of the periods according to some simple or complex key 
suitable for this purpose. Or the bifid and trifid systems may be combined into a single scheme, 
enciphering a text by the bifid method and then reenciphering the cipher text by the trifid 
method and so on. Systems of this sort may become so complex as to defy analysis, especially 
if the keys are constantly and frequently varied so that no great amount of traffic accumulates 
in any single key. Fortunately for the cryptanalyst, however, such complex systems as these, if 
introduced into actual usage, are attended by so many difficulties in practice that the enemy 
cryptographic service would certainly break down and it would not be long before requests for 
repetition, the transmission of the same cryptogram in different keys, and so on, would afford 
clues to solution. Could such systems be employed successfully in field service there is no doubt 
that from the standpoint of security, the cryptograms would be theoretically secure. But the 
danger of error and the slowness with which they could be operated by the usual cryptographic 
clerks are such that systems of this complexity can hardly be employed in the field, and therefore 
the cryptanalyst may not expect to encounter them. 

b. However, the simple bifid system, the ADFGVX system, and the like, are indeed practicable 
for field use, have been used with success in the past, and may be expected to be in use in the 
future. It is therefore advisable that the student become thoroughly familiar with the basic 
principles of their solution and practice the application of these principles as frequently as pos- 
sible. In this connection, the attention of the student is directed to the fact that there is theo- 
retically no reason why the bipartite components of the ADFGVX system cannot be recombined 
by means of the same or a different checkerboard, thus reducing the cryptographic text to a form 
wherein it consists of 25 different letters, and at the same time cutting the length of the messages 
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in half. The matter is purely one of practicability: it adds one more step to the process. But it 
must not be overlooked that this additional step would add a good deal of strength to the system, 
for it would shorten, mask, distort, or entirely eliminate similar beginnings and similar endings — 
the two most fruitful sources of attack on this system. 

56. Concluding remarks on transposition systems. — a. Simple transposition systems hardly 
afford any security at all; complex ones may in the case of individual or single messages afford a 
hi gh degree of security. But just as soon as many cryptograms in the same key are transmitted 
the chances of finding two or more cryptograms of identical length become quite good and the 
general solution may be applied. 

b. Contrary to the situation in the case of substitution, in that of transposition wherein the 
letters of the plain-text itself are transposed (not code) the shorter the cryptogram the greater the 
possibility of solution. For, in the case of a message of say only 25 or 30 letters, one might shift 
the letters about and actually reconstruct the plain text as one does in the case of the game called 
“anagrams.” Of course, several different “solutions” may thus be obtained, but having such 
“solutions” it may be possible to reconstruct the system upon which the transposition was based 
and thus “prove” one of the solutions. 

c. The text has confined itself almost entirely to cases of uniliteral transposition, in order to 
demonstrate basic principles. But there is inherently no reason why transposition may not be 
applied to digraphs, trigraphs, or tetragraphs. If longer sequences are used as the units of 
transposition the security decreases very sharply, as in the case of the ordinary route ciphers of 
the Civil War period. 

d. Transposition designs, diagrams, or patterns are susceptible of yielding cryptograms of 
good security, if they are at all irregular or provide for nulls and blank spaces. Such devices are 
particularly difficult to solve if frequently changed. 

e. Transpositions effected upon fixed-length sequences of plain text yield a low degree of 
security but when a transposition is applied to the cipher text resulting from a good substitution 
system or to the code text of cryptograms first encoded by means of an extensive code book the 
increase in the cryptographic security of such cryptograms is quite notable. In fact, transposi- 
tion methods and designs are frequently used to “super encipher” substitution text or code and 
play a very important role in this field. Their great disadvantage is that inherent in all trans- 
position methods: The addition or deletion of a single letter or two often makes the entire 
cryptogram unreadable even with the correct key. 

/. The dues afforded by messages with similar beginnings, endings, or internal portions, 
and by repetitions of incorrectly enciphered messages without paraphrasing the original text 
are often sufficient to make a solution possible or to facilitate a solution. For this reason the 
cryptanalyst should note all cases wherein dues of this sort may be applicable and be prepared 
to take full advantage of them. 
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